4images Cross Site Scripting / Clickjacking

`# Affected software: 4images  
# Type of vulnerability: clickjacking,xss  
# URL: http://www.4homepages.de/  
# Discovered by: Provensec  
# Website: http://www.provensec.com  
# Description: 4images is a powerful web-based image gallery management  
system. Features include comment system, user registration and mangagement,  
password protected administration area with browser-based upload and HTML  
templates for page layout and design.  
# Proof of concept  
  
1st:click jacking --:  
  
4images was vuln to clickjacking which could be exploited and used to  
delete category  
  
http://i.imgur.com/vqfz8Lk.png  
  
clickjacking poc -:  
  
http://prntscr.com/670r9b  
  
2nd: xss  
  
adding a new category with xss payload leads to persistent xss vuln  
  
http://prntscr.com/670rmi  
  
  
  
  
  
--   
  
Best Regards,  
*Ankit Bharathan.*  
  
*Save Energy... Save Nature... Go Green...*  
P *Consider the environment. Please don't print this e-mail unless  
absolutely necessary.*  
`