Author : Ph03n1X
email : king_purba@yahoo.co.uk
site : http://kandangjamur.net/
vendor : www.vegadns.org
version: 0.99

XSS
----
PoC :
http://exam.com/vegadns/index.php?VD...ee%3E%3C/h1%3E

Vulnerable script is located in index.php file, $message variable isn't validated. You may validate
$_REQUEST['message'] using htmlspecialchars() function.

SQL injection
--------------

http://exam.com/vegadns/index.php?VD...5,6,7,8,9%20--

http://exam.com/vegadns/index.php?VD...count&cid=1%20 AND 1=0

Vulnerable query is located in src/users.php file, You may fix this problem by adding the following
function and then validate $_REQUEST['cid']

<?php
validate($_REQUEST['cid']);

.... bla bla bla ...

function validate($char)
{
if(!is_numeric($char))
{
die("i have received an error request");
}
}
?>