Joomla allCineVid 1.0.0 Blind SQL Injection

`allCineVid Joomla Component 1.0.0 Blind SQL Injection Vulnerability  
  
Name allCineVid  
Vendor http://www.joomtraders.com  
Versions Affected 1.0.0  
  
Author Salvatore Fresta aka Drosophila  
Website http://www.salvatorefresta.net  
Contact salvatorefresta [at] gmail [dot] com  
Date 2011-01-18  
  
X. INDEX  
  
I. ABOUT THE APPLICATION  
II. DESCRIPTION  
III. ANALYSIS  
IV. SAMPLE CODE  
V. FIX  
  
  
I. ABOUT THE APPLICATION  
________________________  
  
allCineVid is a commercial Joomla's extension. It allows  
you to add videos into your Joomla! website through the  
use of modules and lightbox windows.  
  
  
II. DESCRIPTION  
_______________  
  
A parameter is not properly sanitised before being used  
in SQL queries.  
  
  
III. ANALYSIS  
_____________  
  
Summary:  
  
A) Blind SQL Injection  
  
  
A) Blind SQL Injection  
______________________  
  
The id parameter is not properly sanitised before being  
used in SQL queries. This can be exploited to manipulate  
SQL queries by injecting arbitrary SQL code.  
  
  
IV. SAMPLE CODE  
_______________  
  
A) Blind SQL Injection  
  
http://site/path/index.php?option=com_allcinevid&tmpl=component&id=1 and 1=1  
http://site/path/index.php?option=com_allcinevid&tmpl=component&id=1 and 1=0  
  
  
V. FIX  
______  
  
No fix.  
  
`