Joomla Techfolio 1.0 SQL Injection

`###################################################################  
Techfolio 1.0 Component Joomla SQL Injection  
###################################################################  
  
Release Date Bug. 27-Oct-2011  
Date Added. 30-Sep-2011  
Vendor Notification Date. Never  
Product. Techfolio  
Platform. Joomla  
Affected versions. 1.0  
Type. Non-Commercial  
Attack Vector. Sql Injection  
Solution Status. unpublished  
CVE reference. Not yet assigned  
Download. techdeluge.com/joomla-component/com_techfolio.zip  
  
  
I. BACKGROUND  
  
This component is made for portfolio purpose.  
Its easy to integrate and easy to made custom design.  
category based structure.  
this is base component we are in process with upgrade version also.  
with new feature and new functionality which is easy to integrate.  
we will launch it within 10 days.  
  
II. DESCRIPTION  
  
discovered a vulnerability in Techfolio, joomla component,  
vulnerability is SQL injection  
  
The parameters affected are:  
catid  
  
  
III. ANALYSIS  
  
  
file:  
/com_techfolio/frontend/models/techfoliodetail.php  
  
[29] $catid = $_GET['catid'];  
[30] if($catid!=''){  
[31] $data = "SELECT * FROM #__techfolio WHERE catid = ".$catid;  
[32] }else{  
[33] $data = "SELECT * FROM #__techfolio";  
[34] }  
[35] $db->setQuery( $data );  
[36] $data = $db->loadObjectList();  
[37]  
[38] return $data;  
  
query to the variable $catid is not filtered  
  
  
IV. EXPLOITATION  
  
  
parameter [catid]:  
  
//index.php?option=com_techfolio&view=techfoliodetail&catid=1[SQL]  
  
[SQL]=injection sql  
  
  
  
Discovered by.  
Chris Russell  
  
  
`