My Kazaam Notes Management System Multiple Vulnerability

vendor:

Notes Management System

by:

L0rd CrusAd3r aka VSN

N/A

CVSS

N/A

SQLi, XSS, HTML

N/A

CWE

Product Name: Notes Management System

Affected Version From: 1

Affected Version To: 1

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2010

My Kazaam Notes Management System Multiple Vulnerability

Enter the attack parameter on the 'Enter Refernce Number Below' Text box. SQLi Vulnerability: http://server/path/notes.php[sqli], XSS Vulnerability: http://server/path/notes.php[xss], HTML Vulnerability: http://server/path/notes.php[html]

Mitigation:

N/A

Source

Exploit-DB raw data:

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: My Kazaam Notes Management System Multiple Vulnerability
Vendor url:http://www.mykazaam.com
Version:1
Published: 2010-07-11
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
Sai, KD, M4n0j.
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

Use as an order tracking system with Message confirmed, as a progress chart
or an online diary. Operates with file numbers to separate entries

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

Enter the attack parameter on the "Enter Refernce Number Below" Text box

*SQLi Vulnerability

DEMO URL :

http://server/path/notes.php[sqli]

*XSS Vulnerability

DEMO URL:

http://server/path/notes.php[xss]

*HTML Vulnerability

DEMO URL:

http://server/path/notes.php[html]


# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r