creadirectory [injection sql & xss]
Date: 21 Nov 2006 19:58:31 -0000
From: [email protected]
To: [email protected]
Subject: creadirectory [injection sql & xss]
X-Virus-Scanned: antivirus-gw at tyumen.ru
vendor site: http://www.creascripts.com/
product:creadirectory
bug: injection sql & xss
risk : medium
injection sql:
/search.asp?search=1&submit=Search&category='[sql]
xss:
/addlisting.asp?cat=[xss]
/search.asp?search=[xss]
laurent gaffiИ & benjamin mossИ
http://s-a-p.ca/
contact: [email protected]
