Docebo LMS 4.0.3 Cross Site Scripting

`| # Title : Docebo LMS 4.0.3 Multi Vulnerability  
| # Author : indoushka   
| # email : [email protected]   
| # Dork : Powered by Docebo ® Community Edition  
| # Tested on: windows 8.1 Français V.(Pro)   
| # Download : http://www.dl.persianscript.ir/script/DoceboLMS_403(PersianScript.ir).zip  
=======================================  
  
Download empty Config :  
  
http://www.cashlearning.org/docebo/install/download_conf.php  
  
Xss :  
  
This vulnerability affects /doceboLms/index.php.   
  
Attack details :  
  
URL encoded GET input op was set to confirm_999677():;953204  
  
This vulnerability affects /index.php.   
  
Attack details :  
  
URL encoded GET input modname was set to login_921277():;929986  
The input is reflected inside <script> tag.  
  
/index.php?modname=login_921277():;929986&new_lang=turkish&op=lostpwd&special=changelang  
  
Greetz :   
jericho http://attrition.org & http://www.osvdb.org/ * packetstormsecurity.com * http://is-sec.org/cc/  
Hussin-X * Stake (www.v4-team.com) * D4NB4R * ViRuS_Ra3cH * yasMouh * https://www.corelan.be * exploit4arab.net  
---------------------------------------------------------------------------------------------------------------  
`