##############################################################################
#Title:             FlatPress 0.909.1 Stored XSS                             #
#Vendor:            http://www.flatpress.org                                 #
#Dork:              "powered by FlatPress"                                   #
##############################################################################
#AUTHOR:            ITSecTeam                                                #
#Email:             Bug@ITSecTeam.com                                        #
#Website:           http://www.itsecteam.com                                 #
#Forum :            http://forum.ITSecTeam.com                               #
#Original Advisory: www.ITSecTeam.com/en/vulnerabilities/vulnerability32.htm #
#Thanks:            r3dm0v3, Pejvak, am!rkh@n & everyone in the world :D     #
##############################################################################

#DESCRIPTION (by vendor):#####################################################
FlatPress is an open-source standard-compliant multi-lingual extensible 
blogging engine which does not require a DataBase Management System to work.


#BUG:#########################################################################
file fp-plugins/lastcomments/plugin.lastcomments.php:
 52:      $content .=  
 53:      "<li>
 54:      <blockquote class=\"comment-quote\" cite=\"comments.php?entry={$arr['entry']}#{$arr['id']}\">
 55:      {$arr['content']} //<-----vulnerable line!
 56:      <p><a href=\"".get_comments_link($arr['entry']).
 57:      "#{$arr['id']}\">{$arr['name']} - {$entry['subject']}</a></p>
 58:      </blockquote></li>\n";

Unfiltered comment is used to create last comments block!


#EXPLOIT:####################################################################
goto comments and post any script as comment content!