Icy Phoenix 1.3.0.53a HTTP Referer storage Cross-Site Scripting Vulnerability

Icy Phoenix is a highly customizable phpbb-based content management system. Icy Phoenix has a storage-type cross-site scripting vulnerability that may cause cross-site scripting attacks.

[+] Info:
~~~~~~~~~
# Exploit Title: Icy Phoenix 1.3.0.53a http referer stored XSS
# Google Dork: "Powered by Icy Phoenix # Date: 16-2-2011
# Author: Saif El-Sherei
# Software Link: http://www.icyphoenix.com/dload.php? Action = file & file_id = 171
# Version: Icy Phoenix 1.3.0.53a
# Tested on: FF 3.0.15, IE 8
# Vendor Response:
Http://www.icyphoenix.com/viewtopic.php? F = 1 & p = 51700 # p51700

[+] Poc:
~~~~~~~~~
There is a stoed XSS Vulnerability using http referer HTTP header due
Failure in "index. php" in the acp to sanitize the http referer header any
Visitor to the site can comprmise the admin account or any user
Privileges to see the "http referrers" section under the "Info" section.
Attacker has to use an intrcepting proxy or manual server requests to add
The "HTTP referer header" containing the POC to the server request.

POC:
<Script> alert ("XSS"); </script>

[+] Reference:
~~~~~~~~~
Http://www.exploit-db.com/exploits/16199