Active Auction Pro SQL Injection

`1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0  
0 _ __ __ __ 1  
1 /' \ __ /'__`\ /\ \__ /'__`\ 0  
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1  
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0  
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1  
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0  
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1  
1 \ \____/ >> Exploit database separated by exploit 0  
0 \/___/ type (local, remote, DoS, etc.) 1  
1 1  
0 [+] Site : Inj3ct0r.com 0  
1 [+] Support e-mail : submit[at]inj3ct0r.com 1  
0 0  
1 ########################################### 1  
0 I'm L0rd CrusAd3r member from Inj3ct0r Team 1  
1 ########################################### 0  
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1  
Author: L0rd CrusAd3r aka VSN [[email protected]]  
Exploit Title:Active Auction Pro SQl Vulnerable  
Vendor url:http://www.activewebsoftwares.com  
Version:6.2  
Price:488$  
Published: 2010-06-15  
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to all ICW members.  
Spl Greetz to:inj3ct0r.com Team  
  
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~  
  
Description:  
Active Auction is a full featured, affordable auction program for your web site. Features includes Standard and Dutch auctions, set listing fees, rate users, proxy bidding, shopping system and more. Easily can be integrated seamlessly with your existing site. Uses Access or MS SQL database. Includes the full ASp VB source code.  
  
Features  
  
* Allow Users to create Stores  
* Shopping Cart System  
* Save Favorite Searches  
* Summary View  
* Support for GFLAx (http://www.xnview.com/) free image control  
* web based WYSIWYG (What You See Is What You Get) auction listing editor  
* Upload up to 5 pictures/documents per item listing  
* Allow Standard Auction,"Buy It Now" and Trade  
* Reverse Auction  
* Define unlimited depth and number of categories  
* Set the Percentage Payment based on the winning bid  
* Listing enhancement fees: Featured Item Fee, Gallery Fee, Bold Item Fee and Highlighted Item Fee  
* Automatically create Gallery Picture or Thumbnail (requires ASPImage)  
* Account Payment Ledger  
* Automatic credit card processing using Paypal or Authorize.net  
* Items Bidding Module   
  
  
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~  
  
Vulnerability:  
  
*SQLi Vulnerability  
  
DEMO URL :  
  
http://www.activewebsoftwares.com/demoactiveauction/default.asp?catid=[sqli]  
  
# 0day n0 m0re #  
# L0rd CrusAd3r #  
  
`