rapid7/metasploit-framework — pull request #2691 by F1gure8 (2013-11-26 07:17:39+00:00)
Title: Module cve2013 4715

Module for CVE-2013-4715, Tiki Wiki CMS Groupware SQL Injection. It calls sqlmap against the vulnerable search request parameter, so sqlmap must be installed for the exploit to run. For the installation to be vulnerable, it must be version (<6.13, <9.7, <10.4, 11.0) and must have the MySQL full-text search enabled. The default install for 6.x versions might require authentication before a search can be done. The SQL injection is on the searchLang parameter and appears to be a blind injection.

Since MSF is calling sqlmap, any logs are sent back to the sqlmap output directory. Sending sqlmap output to MSF loot has not been built into the module. The filedropper include may not be necessary and I have not tested the handler with a shell being sent back by sqlmap.

Testing:

- Install a vulnerable version of Tiki Wiki CMS (http://doc.tiki.org/Documentation).
- Log in as administrator.
- Go to /tiki-admin.php?page=search&alt=Search
- Check the "MySQL Full-Text Search" box and click the button labeled "Change Preferences". It should now be ready for MSF testing.
- The module check function only attempts to cause a page to be returned with regex /db_error/
- The URI option is required and must be correct for the installation path (e.g. tiki/)
- The BATCH option was set as required, true or false.
- The SQLMAP_PATH is also required.
- Additional sqlmap options can be specified if proceeded by -- (parsing of single dash options was not included) e.g. set OPTS --beep --cleanup

Arbitrary SQL queries writing to the database are possible. I've succeeded in reading from tables and dropping tables during testing. Theoretically you should also be able to load a stager through the Tiki content itself, even if the webroot is not writable, but I haven't tested that.

Final note: this is my first attempt at a Metasploit module and I'm not familiar with developing through git. Please review thoroughly and let me know of any errors/blunders/faux pas during this process for my own information going forward.