Bugtraq mailing list archives

SQL injection & XSS IN vbzoom v1.11

From: "???? ????" <mr_snake_my () hotmail com>
Date: Mon, 06 Mar 2006 22:09:41 +0000

Software: vbzoom v1.11

Web Site:http://www.vbzoom.com

Versions: V1.11

== SQL Injection ==

http://www.victem.com/vz/show.php?UserID=1&MainID=1&SubjectID=[SQL]

http://www.victem.com/vz/show.php?UserID=1&MainID=[SQL]&SubjectID=1

==== XSS ====

http://www.victem.com/vz/comment.php?UserID=&apos;>XSS

http://www.victem.com/vz/profile.php?UserID=1&UserName=&apos;>XSS

http://www.victem.com/vz/contact.php?UserID=&apos;>XSS


Discovered by: Mr.SNAKE

FROM http://www.lezr.com

_________________________________________________________________

Express yourself instantly with MSN Messenger! Download today it's FREE!http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

Current thread:

SQL injection & XSS IN vbzoom v1.11 ???? ???? (Mar 06)