2daybiz Online Classified System SQL Injection / Cross Site Scripting

`  
  
===========================================================  
2daybiz online classified system SQLi AND XSS Vulnerability  
===========================================================  
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0  
0 _ __ __ __ 1  
1 /' \ __ /'__`\ /\ \__ /'__`\ 0  
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1  
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0  
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1  
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0  
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1  
1 \ \____/ >> Exploit database separated by exploit 0  
0 \/___/ type (local, remote, DoS, etc.) 1  
1 1  
0 [+] Site : Inj3ct0r.com 0  
1 [+] Support e-mail : submit[at]inj3ct0r.com 1  
0 0  
1 ########################################## 1  
0 I'm Sid3^effects member from Inj3ct0r Team 1  
1 ########################################## 0  
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1  
  
Name : 2daybiz online classified system SQLi AND XSS Vulnerability  
Date : june, 16 2010  
Vendor url :http://www.2daybiz.com/online_classified_script.html  
Critical Level : HIGH  
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>  
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,gunslinger_  
greetz to :All ICW members and my friends :) luv y0 guyz   
#######################################################################################################  
DESCRIPTION:  
2daybiz online classified system allows you to start a fully automated classified ads site that includes essential features present in major classifieds sites. Our powerful script written in PHP allows your users to post new ads, for which you can charge a predefined amount. Billing is handled automatically and seamlessly through many of the popular payment gateways. Our classified ads software is fast, simple and fully customized through our built-in editor.  
  
#######################################################################################################  
Xploit: SQLI Vulnerability   
  
DEMO URL : http://2daybiz.com/products/orkutclone/view_photo.php?page=3&alb=[SQLI]  
###############################################################################################################  
Xploit: XSS Vulnerability   
  
Attack Pattern: '"-->  
DEMO URL :http://www.2daybiz.com/products/classified/headersearch.php?sid=[XSS]  
###############################################################################################################  
# 0day no more   
# Sid3^effects   
  
  
  
  
  
  
`