Administrator credential disclosure via hard_user SQL injection

SQL injection in Netentsec NS-ASG 6.3 allows remote authenticated users to read administrator credentials via hard_user. The applyhardware.php action inserts the URL-decoded hard_user parameter into an SQL statement without neutralizing metacharacters; the published payload uses extractvalue errors to expose adminname and passwd fields from the Admin table. Low-privileged access to the web interface is required, and the documented consequence is disclosure of stored administrator credentials.