<HTML dir=ltr><HEAD>
<META http-equiv=Content-Type content="text/html; charset=unicode">
<META content="MSHTML 6.00.3790.0" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial color=#000000 size=2><FONT size=2>
<P>-=[--------------------ADVISORY-------------------]=-</P>
<P></P>
<P></FONT><I><FONT face="Times New Roman"><FONT size=3>phpListPro</FONT></I><FONT size=3> </FONT></P></FONT><FONT size=2>
<P><FONT size=3></FONT></P>
<P>Author: CorryL [corryl80@gmail.com] </P>
<P>-=[-----------------------------------------------]=-</P>
<P> </P>
<P>-=[+] Application: </FONT><I><FONT face="Times New Roman"><FONT size=3>phpListPro</FONT></P></I></FONT><FONT size=2>
<P>-=[+] Version: 2.0.1</P>
<P>-=[+] Vendor's URL: http://www.smartisoft.com/</P>
<P>-=[+] Platform: Windows\Linux\Unix</P>
<P>-=[+] Bug type: Persistent Cross-Site Script</P>
<P>-=[+] Exploitation: Remote</P>
<P>-=[-]</P>
<P>-=[+] Author: CorryL ~ corryl80[at]gmail[dot]com ~</P>
<P>-=[+] Reference: http://corryl.altervista.org/</P>
<P>-=[+] Irc Chan: irc.darksin.net #x0n3-h4ck </P>
<P> </P>
<P> </P>
<P> </P>
<P>..::[ Proof Of Concept ]::..</P>
<P>PhplistPro is affected from a called bug persistent XSS, </P>
<P>in practice the script doesn't filter the information </P>
<P>that have passed through form for the application </P>
<P>of insertion of a web site, allowing a remote attacker </P>
<P>to insert a script xss and to draw information from all the people that access the page.</P>
<P> </P>
<P>..::[ Exploit ]::..</P>
<P>download exploit from my private area in my web site:</P>
<P>http://corryl.altervista.org/index.php?mod=Area_Privata</P></FONT></FONT></DIV></BODY></HTML>