Bugtraq mailing list archives
Mega Mall [ multiples injection sql & full path disclosure ]
From: saps.audit () gmail com
Date: 12 Nov 2006 19:51:42 -0000
vendor site: http://products.kaonsoftwares.com/ product: mega-mall bug:injection sql & full path disclosure language: asp risk: high injection sql (get): http://site.com/mega-mall/product_review.php?t=[sql] http://site.com/mega-mall/product_review.php?t=0&productId=[sql] http://site.com/mega-mall/product_review.php?t=0&productId=1004&sk=[sql] http://site.com/mega-mall/product_review.php?t=0&productId=1004&t=0&x=[sql] http://site.com/mega-mall/product_review.php?t=0&productId=1004&sk=USERID&so=[sql] injection sql (post) : http://site.com/mega-mall/order-track.php Variables: /mega-mall/order-track.php?Enter=1&orderNo=[sql] full path dislosure: http://site.com/mega-mall/product_review.php?t=0&productId=1004&t=0&x[]= laurent gaffié & benjamin mossé http://s-a-p.ca/ contact: saps.audit () gmail com
Current thread:
- Mega Mall [ multiples injection sql & full path disclosure ] saps . audit (Nov 13)