Bugtraq mailing list archives

creadirectory [injection sql & xss]

From: saps.audit () gmail com
Date: 21 Nov 2006 19:58:31 -0000

vendor site: http://www.creascripts.com/
product:creadirectory
bug: injection sql & xss
risk : medium 


injection sql:
/search.asp?search=1&submit=Search&category='[sql]


xss:
/addlisting.asp?cat=[xss]
/search.asp?search=[xss]


laurent gaffié & benjamin mossé
http://s-a-p.ca/
contact: saps.audit () gmail com

Current thread:

creadirectory [injection sql & xss] saps . audit (Nov 21)