Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability

vendor:

Clickbank Affiliate Marketplace Script

by:

L0rd CrusAd3r aka VSN

6,4

CVSS

MEDIUM

SQLi, XSS, HTML, URL Redirection

89, 79, 80, 601

CWE

Product Name: Clickbank Affiliate Marketplace Script

Affected Version From: 1

Affected Version To: 1

Patch Exists: YES

Related CWE: N/A

CPE: edgephp.com

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability

Let your users search all listings or just show products from your niche. No matter what interest brings visitors to your site, there's a good chance those visits can be monetized with Clickbank. CBQuick has just been improved again, is completely Clickbank TOS compliant, and now includes the following: Click Tracking, One Click Updates, No Duplicate Listings, Product Stats.

Mitigation:

Input validation, sanitization, and output encoding.

Source

Exploit-DB raw data:

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Edgephp Clickbank Affiliate Marketplace Script Multiple
Vulnerability
Vendor url:http://www.edgephp.com
Version:1
Published: 2010-07-11
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
Sai, KD, M4n0j.
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

Let your users search all listings or just show products from your niche. No
matter what interest brings visitors to your site, there's a good chance
those visits can be monetized with Clickbank.
CBQuick has just been improved again, is completely Clickbank TOS compliant,
and now includes the following:

Click Tracking
One Click Updates
No Duplicate Listings
Product Stats

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL:

http://server/index.php?search=[sqli]

*XSS Vulnerability

DEMO URL:

http://server/index.php?search=[xss]

*HTML Vulnerability

DEMO URL:

http://server/index.php?search=[html]

*URL Redirection

# 0day n0 m0re #
# L0rd CrusAd3r #

-- 
With R3gards,
L0rd CrusAd3r