MercuryBoard 1.1.4 SQL Injection

RST/GHC Advisory #28
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Product : MercuryBoard 
Version : 1.1.4

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FILE : index.php
VULN : SQL injection

CODE : 
global.php
----------
71 : $this->agent   = isset($_SERVER['HTTP_USER_AGENT']) ? 
$_SERVER['HTTP_USER_AGENT'] : null;

index.php
---------
154 : $mercury->db->query("REPLACE INTO {$mercury->pre}active (active_id, 
active_action, active_item, active_time, 
active_ip, active_user_agent, active_session) VALUES 
({$mercury->user['user_id']}, '{$mercury->get['a']}', $item, 
$mercury->time, '$mercury->ip', '$mercury->agent', 
'{$mercury->session['id']}')");

INFO : 
-->--
GET /mercuryboard/ HTTP/1.1
User-Agent: 666'
Host: 127.0.0.1
--<--
...
You have an error in your SQL syntax. Check the manual that corresponds to your 
MySQL server version for the right 
syntax to use near 'aa3211413f374429d3830cd062b25b86')' at line 1
Query Error [1064]:
This type of error is reported by MySQL.
Query: REPLACE INTO mb_active (active_id, active_action, active_item, 
active_time, active_ip, active_user_agent, active_session) VALUES (1, 'board', 
0, 1116314234, '127.0.0.1', '666'', 'aa3211413f374429d3830cd062b25b86')
...

EXPLOIT:
http://rst.void.ru/download/r57mercury.txt
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1dt.w0lf 
RST/GHC
http://rst.void.ru
http://ghc.ru