[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
creadirectory [injection sql & xss]
- To: bugtraq@xxxxxxxxxxxxxxxxx
- Subject: creadirectory [injection sql & xss]
- From: saps.audit@xxxxxxxxx
- Date: 21 Nov 2006 19:58:31 -0000
vendor site: http://www.creascripts.com/
product:creadirectory
bug: injection sql & xss
risk : medium
injection sql:
/search.asp?search=1&submit=Search&category='[sql]
xss:
/addlisting.asp?cat=[xss]
/search.asp?search=[xss]
laurent gaffié & benjamin mossé
http://s-a-p.ca/
contact: saps.audit@xxxxxxxxx