Visitors Google Map Lite 1.0.1 SQL Injection

`Visitors Google Map Lite 1.0.1 (FREE) (module mod_visitorsgooglemap Remote Sql Injection)  
=========================================================================================  
  
- Discovered by : Chip D3 Bi0s  
- Email : chipdebios[at]gmail[dot]com  
- Group : LatinHackTeam  
- Date : 2010-09-08  
- Where : From Remote  
  
-------------------------------------------------------------------------------------  
Affected software description  
  
Application : Visitors Google Map Lite 1.0.1 (FREE) (module:mod_visitorsgooglemap)  
Developer : Serdar Gökkus  
Compatibility : Joomla 1.5 Native  
License : GPLv2 or later  
Date Added : Sunday August 29, 2010 01:14:14  
Download : http://www.comlantis.com/download/doc_download/2-visitors-google-map-lite-101-free.html  
  
I. BACKGROUND  
  
This extension tracks visitors of your site in real time and displays their  
locations in Google Map. It uses three main technologies:  
  
- Map API of Google  
- AJAX  
- IP geolocation API of IPInfoDB  
  
Content of VisitorsGoogeMap Package:  
This extension contains one Joomla Compoment and two Joomla Modules.  
  
com_visitorsgooglemap: This component is responsible for the creation  
database table during installation and remove  
it clearly in case of uninstallation.  
  
mod_visitorsgooglemap: This module is responsible for the display of  
Google Map in desired module position in your  
template and track the visitors of your Joomla  
page in the map.  
  
mod_visitorsgooglemap_agent: This module is responsible for the updating  
visitors information in the database.  
  
II. DESCRIPTION  
  
Some sql injecton vulnerabilities exist in mod_visitorsgooglemap module .  
  
  
III. ANALYSIS  
  
The bug is in the following files, specifying the lines  
  
/mod_visitorsgooglemap/map_data.php  
  
  
[16] [if ($_GET['action'] == 'listpoints')  
[17] {  
[18] $lastMarkerID = $_GET['lastMarkerID'];  
[19] ini_set('default_mimetype','text/xml'); // manchmal notwendig  
[20] header ('Content-Type: text/xml'); // reicht nicht immer  
[21] echo '<?xml version="1.0" ?>';  
[22] echo '<xmlresponse>';  
[23] $database =& JFactory::getDBO();  
[24] $query = "SELECT * FROM #__visitorsgooglemap_location where id > $lastMarkerID order by id";  
  
Explanation:As noted in the line [24] $ lastMarkerID  
nowhere is filtered, which result in a query pede unexpected  
  
  
IV. EXPLOITATION  
  
http://site/path/modules/mod_visitorsgooglemap/map_data.php?action=listpoints&lastMarkerID=0{sql}  
  
  
  
  
+++++++++++++++++++++++++++++++++++++++  
[!] Produced in South America  
+++++++++++++++++++++++++++++++++++++++  
  
`