Joomla Techfolio 1.0 SQL Injection

###################################################################
Techfolio 1.0 Component Joomla SQL Injection
###################################################################
 
Release Date Bug.          27-Oct-2011
Date Added.                30-Sep-2011
Vendor Notification Date.  Never
Product.                   Techfolio
Platform.                  Joomla
Affected versions.         1.0
Type.                      Non-Commercial
Attack Vector.             Sql Injection
Solution Status.           unpublished
CVE reference.             Not yet assigned
Download.                  techdeluge.com/joomla-component/com_techfolio.zip
 
 
I. BACKGROUND
 
This component is made for portfolio purpose.
Its easy to integrate and easy to made custom design.
category based structure.
this is base component we are in process with upgrade version also.
with new feature and new functionality which is easy to integrate.
we will launch it within 10 days.
 
II. DESCRIPTION
 
discovered a vulnerability in Techfolio, joomla component,
vulnerability is SQL injection
 
The parameters affected are:
catid
 
 
III. ANALYSIS
 
 
file:
/com_techfolio/frontend/models/techfoliodetail.php
 
[29] $catid = $_GET['catid'];
[30]        if($catid!=''){
[31]            $data = "SELECT * FROM #__techfolio WHERE catid = ".$catid;
[32]        }else{
[33]            $data = "SELECT * FROM #__techfolio";
[34]        }
[35]        $db->setQuery( $data );
[36]        $data = $db->loadObjectList();
[37]
[38]        return $data;
 
query to the variable $catid is not filtered
 
 
IV.  EXPLOITATION
 
 
parameter [catid]:
 
//index.php?option=com_techfolio&view=techfoliodetail&catid=1[SQL]
 
[SQL]=injection sql
 
 
 
Discovered by.
Chris Russell