Hotel / Resort Site Script SQL Injection

`  
  
Author: L0rd CrusAd3r aka VSN [[email protected]]  
Exploit Title:Hotel / Resort Site Script with OnLine Reservation System  
SQLi Vulnerable  
Published: 2010-06-08  
Vendor url:http://www.mformula.com.br  
Greetz to:Sid3^effects, aa_Numb, M4n0j and to all ICW members  
  
#############################################################################################################################################################################  
  
DESCRIPTION:  
  
Internal system for total administration of the site.  
Available site in the languages Portuguese, Spanish, Japanese, English,  
Italian, French & German.  
System and reservation advanced search onnline/offline, Control of orders  
and reservations, RSS/XML feed, Optimization in search engines, SiteMap  
Google,  
Yahoo and Bing, Support Inns, Hotel and Resorts, Unlimited Gallery of  
Photos, Supported to any type of personalized option (Color, Size, Type,  
etc), Tool of relationship between services, Tool of newsletters for  
customers,  
Personalization of the layout, colors and texts of the site in agreement  
your mark, Reports detailed on the site  
###############################################################################################################################################################################  
  
Vulnerability:  
  
contains SQLi Vulenrable.  
  
demo URL:-  
http://hotel.mformula.com.br/extrapage.php?cat_id=-1'[SQLi]  
  
################################################################################################################################################################################  
--   
With R3gards,  
L0rd CrusAd3r  
  
  
  
`