AutoPartsWarehouse SQL Injection

`==============================================================  
===================[¦¦¦¦TeamQuarantine¦¦¦¦]===================  
===================[¦¦¦¦ 2009 ¦¦¦¦]===================  
============[¦¦¦¦[email protected]¦¦¦¦]=============  
===================[¦¦¦¦ Author: Gm0 ¦¦¦¦]===================  
==============================================================  
==============[¦¦¦¦ autopartswarehouse.com ¦¦¦¦]==============  
========[¦¦¦¦ SQL Injection Authentication bypass ¦¦¦¦]=======  
==============================================================  
==============================================================  
A Site Note:  
I don't usually post site-specific exploits, but due to the  
fact that they have IGNORED all of our attempts to explain this  
issue to them, I feel they would learn best if more people  
showed them what a problem this could be.   
Be nice... ;)  
  
==============================================================  
======================[¦¦¦¦ USAGE: ¦¦¦¦]======================  
==============================================================  
Vulnerable: https://www.autopartswarehouse.com/myaccount/login/  
  
1) Fire up your favorite HTTP/HTTPS post/header editor   
(tamperdata)  
  
2) Supply valid email-address credentials and password (due  
to client-side validation), or simply modify client side  
validaton with firebug to accept "improper" email-address  
formatting  
  
3) Modify 'username' and 'password' parameter values to  
' OR 1=1--  
(simple, I know, which is why they should be informed)  
  
4) Submit modified request  
  
5) Click 'edit profile' link for proof of logged-in status  
(https://www.autopartswarehouse.com/myaccount/edit_profile/)  
  
==============================================================  
====================[¦¦¦¦ FINAL WORD ¦¦¦¦]====================  
==============================================================  
I _KNOW_ more can be done with this.  
Explore, learn, have fun. (be responsible)  
Maybe now they will take notice . . .  
  
==============================================================  
======================[¦¦¦¦ SHOUTZ ¦¦¦¦]======================  
==============================================================  
Everyone at TeamQuarantine  
Including _YOU_ A.G.  
But certainly not J.L.  
  
HA!`