Newsletter 4.3 SQL Injection

`[-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-]  
  
Exploit Title : Newsletter 4.3 SQL Injection Vulnerability  
  
Exploit Author : Ashiyane Digital Security Team  
  
Vendor Homepage: www.conpresso.de - www.conpresso4.de  
  
Google Dork ONE: intext:Module Newsletter 4.3  
  
Google Dork TWO: Module Newsletter 4.3 by www.conpresso4.de  
  
Date : 2015-05-21  
  
Tested On : linux Kali + Windows Se7en  
  
Link Software : http://www.conpresso4.de/_data/cpo4_mod_newsletter_4.3e.zip  
  
[-][-][-][-][-][-][-][-][-][-] DESCRITION [-][-][-][-][-][-][-][-][-][-]  
  
newsletter Module SQL Injection Vulnerability  
Researched by Ashiyane Security Researcher Team  
  
[-][-][-][-][-][-][-][-][-][-] Location [-][-][-][-][-][-][-][-][-][-][-]  
  
http://localhost/[patch]/mod_newsletter/preview.php?action=preview&nr=( SQL )  
  
[-][-][-][-][-][-][-][-][-] Vulnerability CODE [-][-][-][-][-][-][-][-][-]  
  
======= includes/inc_preview.inc.php ========  
  
<?php  
if (!defined('CPO')) exit;  
  
if (!is_numeric($_GET['nr'])) exit;  
  
$query = "SELECT commentary, verfallsdatum, templates_id, nr, idx,   
email, autor, pub_datum, titel, initial, freigabe "  
."FROM ".CPO_NEWS." "  
."WHERE nr=".(int)$_GET['nr']." ";  
  
DEBUG(2, $query, __FILE__, __LINE__);  
$db = new DB;  
$db->query($query);  
  
$db->next_record();  
$db_template = $db->v('templates_id');  
$db_nr = $db->v('nr');  
$db_idx = $db->v('idx');  
$db_email = $db->v('email');  
$db_autor = $db->v('autor');  
$db_pub_datum = $db->v('pub_datum');  
$db_verfallsdatum = $db->v('verfallsdatum');  
$db_commentary = $db->v('commentary');  
$db_titel = $db->v('titel');  
$db_initial = $db->v('initial');  
$db_freigabe = $db->v('freigabe');  
  
$pagetype = 'detail';  
require(CPO_BASEDIR.$activeModules[$directory]['directory'].'/includes/inc_output.inc.php');  
?>  
  
[-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-]  
  
Discovered by : SeRaVo.BlackHat >> H.4.S.S.4.N <<  
  
Special Tnx : Hamed Nikpour - Hesam Bazvand - H_SQLI.EMpiRe - Rezahck23  
  
Mohammad habili - Alireza Akhtari - Und3rgr0und - EviL ShaDoW - ACCESS  
  
[-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-][-]  
`