echo "Joomla <= 1.0.9 'Weblinks' blind SQL injection / admin credentials\r\n";
echo "disclosure exploit (benchmark() vesion)\r\n";
echo "by rgod rgod@autistici.org\r\n";
echo "site: http://retrogod.altervista.org\r\n";

/**
* Saves the record on an edit form submit
* @param database A database connector object
*/
function saveWeblink( $option ) {
   global $mosConfig_mailfrom, $mosConfig_fromname;
   global $database, $my;

   if ($my->gid < 1) {
      mosNotAuth();
      return;
   }

/**
* Saves the record on an edit form submit
* @param database A database connector object
*/
function saveWeblink( $option ) {
   global $mosConfig_mailfrom, $mosConfig_fromname;
   global $database, $my;

   if ($my->gid < 1) {
      mosNotAuth();
      return;
   }
   
   // security check to see if link exists in a menu
   $link = 'index.php?option=com_weblinks&task=new';
   $query = "SELECT id"
   . "\n FROM #__menu"
   . "\n WHERE link LIKE '%$link%'"
   . "\n AND published = 1"
   ;
   $database->setQuery( $query );
   $exists = $database->loadResult();
   if ( !$exists ) {                  
      mosNotAuth();
      return;
   }

// until full edit capabilities are given for weblinks - limit saving to new weblinks only
   $row->id = 0;

// until full edit capabilities are given for weblinks - limit saving to new weblinks only
   $row->id = 0;

   if(stristr($row->title, 'SELECT') && stristr($row->title, 'FROM') && stristr($row->title, 'WHERE')){
     echo "<script> alert('Illegal characters in title'); window.history.go(-1); </script>\n";
      exit();
   }

'
removed for security reasons
--------------------------------------------------------------------