vendor site: http://www.creascripts.com/ 
product:creadirectory
bug: injection sql & xss
risk : medium 


injection sql:
/search.asp?search=1&submit=Search&category='[sql]


xss:
/addlisting.asp?cat=[xss]
/search.asp?search=[xss]


laurent gaffi=E9 & benjamin moss=E9
http://s-a-p.ca/ 
contact: saps.audit@gmail.com