PhpListPro Persistent XSS Vulnerability

[corrado.liotta () alice it]

-=[--------------------ADVISORY-------------------]=-
                                              
                     phpListPro 
                                               
  Author: CorryL    [corryl80 () gmail com]   
-=[-----------------------------------------------]=-


-=[+] Application:    phpListPro
-=[+] Version:        2.0.1
-=[+] Vendor's URL:   http://www.smartisoft.com/
-=[+] Platform:       Windows\Linux\Unix
-=[+] Bug type:       Persistent Cross-Site Script
-=[+] Exploitation:   Remote
-=[-]
-=[+] Author:           CorryL  ~ corryl80[at]gmail[dot]com ~
-=[+] Reference:       http://corryl.altervista.org/
-=[+] Irc Chan:         irc.darksin.net #x0n3-h4ck        




..::[ Proof Of Concept ]::..

PhplistPro is affected from a called bug persistent XSS, 
in practice the script doesn't filter the information 
that have passed through form for the application 
of insertion of a web site, allowing a remote attacker 
to insert a script xss and to draw information from all the people that access the page.


..::[ Exploit ]::..

download exploit from my private area in my web site:

http://corryl.altervista.org/index.php?mod=Area_Privata