Dominant Creature BBG/RPG Browser Game Persistent XSS

                                                ===================================================================================
 Dominant Creature BBG/RPG browser game XSS vulnerabilities
===================================================================================
# Exploit Title: Dominant Creature BBG/RPG browser game XSS vulnerabilities
# Author: M.Jock3R 
# Script support: http://www.bbgdev.com/ 
# Script Download: http://sourceforge.net/projects/dcreature/
# Dork: core engine by Dominant Creature
# Category:: webapps
# Tested on: windows XP Sp2 FR
===================================================================================

Examples:
---------
1) http://creatures.site88.net/
2) http://dixieandtheninjas.net/goofing/DC/
3) http://tux.isa-geek.org/rpg/dm/login.php


Vuln file: msg.php

Vuln code:
---------
	$m = new Msg;
	if (isset($_GET["p"]) && isset($_GET["write"])) {
		$m->Write();
	}
	else {
	    $m->Inbox();
	}
}


Exploit:
---------

-You must  first login :(
You can  enter this account .. For test :)

http://raw.bplaced.net/games/dominantcreature/

username: m.jock3r
password: 01230123

Go to :

Duel opponents ==> Search for opponents : choose any user and enter Write message 

In message box write :

<script>alert(document.cookie)</script>

Click Send message.

-Enjoy playing with XSS :)


===================================================================================
Greets To :
adelsbm / attiadona  / the-code.tk

Email : [email protected]
  
THANKS TO ALL ALGERIANS HACK3RS
===================================================================================