Exploit Discoverd By Novalok & Kasper Of KasaNova Security<br>Coded By A Friend<br><?php<br><br>/*<br>Vendor : Devellion Limited 2006<br>Exploit: Blind SQL injection (look below for more info)<br>Impact: **** of *****
<br>Discovered by: KasaNova Security<br>--------------------------------------------------------------------------------<br>Explanation And Proof:<br><br>File: db.inc.php <br><br>the $query= is not protected efficiently accepting blind SQL injections.
<br>We can tell this becuase when tested on <a href="http://milliemoos.com">milliemoos.com</a><br>With String "GET /classes/db.inc.php?SELECT%20cat_father_id%20FROM%20%22.<br> $glob['CubeCart'].%22CubeCart_category%20WHERE%20cat_id%20=68;"
<br>I get a 200 Http OK reply. I can see this from the packets<br>-------------------------------------------------------------------------------<br><br>There Are most likly More injrctions. But this was all <br>i found. I Didn not try to exploit. Just tryied to find it
<br><br>-Novalok<br><br>KasaNova Secuirty<br><br>*/<br><br>$query = $_POST["query"];<br>$target = $_POST["target"];<br><br>$form= "<form method=\"post\" action=\"".$PHP_SELF."\">"
<br> ."target:<br><input type=\"text\" name=\"target\" size=\"90\" value=\"".$target."\"><br>"<br> ."query:<br><input type=\"text\" name=\"query\" size=\"90\" value=\"\"><br>"
<br> ."<input type=\"submit\" value=\"Submit\" name=\"submit\">"<br> ."</form><HR WIDTH=\"650\" ALIGN=\"LEFT\">";<br><br>if (!isset($_POST['submit']))
<br>{<br><br>echo $form;<br><br>}else{<br><br>//Building Raw Byte Packet<br>//Needed For Blind SQL Injection<br><br>$packetr = "5vdmFsb2sgaXMgYSBmdWNraW5nIG1vcm9uPbiBWdWxuZXF"<br> ."xcXJhYmlsaXR5IGJ1dCB0b28gYmFkIGhlIGhhcXFxcyBub"
<br> ."yBpZGVhIHdoYXQgaGVxcXFzIHRhbGtpbmcgYWJvdXQuIGx"<br> ."vbG9vm92YWxvayBpcyBhIGZ1Y2tpbmcgbW9yb249uIFZ1b"<br> ."G5lcXFxcmFiaWxpdHkgYnV0IHRvbyBiYWQgaGUgaGFxcXF"<br> ."zIG5vIGlkZWEgd2hhdCBoZXFxcXMgdGFsa2luZyBhYm91d"
<br> ."C4gbG9sb2+b3ZhbG9rIGlzIGEgZnVja2luZyBtb3Jvbj24"<br> ."gVnVsbmVxcXFyYWJpbGl0eSBidXQgdG9vIGJhZCBoZSBoY"<br> ."XFxcXMgbm8gaWRlYSB3aGF0IGhlcXFxcyB0YWxraW5nIGF"<br> ."ib3V0LiBsb2xvb5vdmFsb2sgaXMgYSBmdWNraW5nIG1vcm"
<br> ."9uPbiBWdWxuZXFxcXJhYmlsaXR5IGJ1dCB0b28gYmFkIGh"<br> ."lIGhhcXFxcyBubyBpZGVhIHdoYXQgaGVxcXFzIHRhbGtpb"<br> ."mcgYWJvdXQuIGxvbG9vm92YWxvayBpcyBhIGZ1Y2tpbmcg"<br> ."bW9yb249uIFZ1bG5lcXFxcmFiaWxpdHkgYnV0IHRvbyBiY"
<br> ."WQgaGUgaGFxcXFzIG5vIGlkZWEgd2hhdCBoZXFxcXMgdGF"<br> ."sa2luZyBhYm91dC4gbG9sb2+b3ZhbG9rIGlzIGEgZnVja2"<br> ."luZyBtb3JvZOb3ZhbG9rIGlzIGEgZnVja2luZyBtb3Jvbu"<br> ."PbiBWdWxuZXFxcXJhYmlsaXR5IGJ1dCB0b28gYmFkIGhlI"
<br> ."GhhcXFxcyBubyBpZGVhIHdoYXQgaGVxcXFzIHRhbGtpbmc"<br> ."gYWJvdXQuIGxvbG9vm92YWxvayBpcyBhIGZ1Y2tpbmcgbW"<br> ."9yb249uIFZ1bG5lcXFxcmFiaWxpdHkgYnV0IHRvbyBiYWQ"<br> ."gaGUgaGFxcXFzIG5vIGlkZWEgd2hhdCBoZXFxcXMgdGFsa"
<br> ."2luZyBhYm91dC4gbG9sb2+b3ZhbG9rIGlzIGEgZnVja2lu"<br> ."ZyBtb3Jvbj24gVnVsbmVxcXFyYWJpbGl0eSBidXQgdG9vI"<br> ."GJhZCBoZSBoYXFxcXMgbm8gaWRlYSB3aGF0IGhlcXFxcyB"<br> ."0YWxraW5nIGFib3V0LiBsb2xvb5vdmFsb2sgaXMgYSBmdW"
<br> ."NraW5nIG1vcm9uPbiBWdWxuZXFxcXJhYmlsaXR5IGJ1dCB"<br> ."0b28gYmFkIGhlIGhhcXFxcyBubyBpZGVhIHdoYXQgaGVxc"<br> ."XFzIHRhbGtpbmcgYWJvdXQuIGxvbG9vm92YWxvayBpcyBh"<br> ."IGZ1Y2tpbmcgbW9yb249uIFZ1bG5lcXFxcmFiaWxpdHkgY"
<br> ."nV0IHRvbyBiYWQgaGUgaGFxcXFzIG5vIGlkZWEgd2hhdCB"<br> ."oZXFxcXMgdGFsa2luZyBhYm91dC4gbG9sb2w=="; <br><br><br>//Sending Raw Request via Base64_Decode Request Method<br><br>$result = base64_decode($packetr);
<br>if (!$result) {<br> echo "<p>Unable to get output of query. Try Another Query or Server May be Down\n";<br> exit;<br>}else{<br><br>echo "Raw Ouput From Server:<br><br>".$result;
<br><br>}<br><br>echo $form;<br><br><br><br>}<br>?>