[VulnDiscuss] Snitz Forums 3.3.03 SQL Injection, Remote Command Execution

Snitz Forums 3.3.03, and probably other versions, is vulnerable to an
SQL injection attack.  This gives attackers non-interactive remote command
execution, usually with SYSTEM privileges.

The vulnerable code is in "register.asp" with the variable "Email". 
Because input is not checked, attackers can input SQL commands.  This
includes MS SQL stored procedures, such as "xp_cmdshell".

Vendor was emailed last month, but no response has been given.

Attached is an example exploit written in Perl.  IIS only logs a "200
OK" for "register.asp".