130 lines
No EOL
4.6 KiB
Text
130 lines
No EOL
4.6 KiB
Text
Title:
|
||
======
|
||
ES Job Search Engine v3.0 - SQL injection vulnerability
|
||
|
||
|
||
Date:
|
||
=====
|
||
2012-08-09
|
||
|
||
|
||
References:
|
||
===========
|
||
http://www.vulnerability-lab.com/get_content.php?id=675
|
||
|
||
|
||
VL-ID:
|
||
=====
|
||
675
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
8.1
|
||
|
||
|
||
Introduction:
|
||
=============
|
||
ES Job Search Engine Script is the most powerful, affordable and flexible spider meta job search engine script.
|
||
In one simple search, ES Job Search Engine gives job seekers free access to thousands of employment opportunities
|
||
because it search for jobs from many different sites (job websites, job boards, newspapers, associations, company
|
||
career pages), you’ll find more opportunities here than if you just searched for jobs on a single job posting site.
|
||
It is easy to use: just install it and your job search site is ready.
|
||
|
||
(Copy of the Vendor Homepage: http://www.es-job-search-engine.com )
|
||
|
||
|
||
Abstract:
|
||
=========
|
||
A Vulnerability Laboratory Researcher of the Vulnerability Laboratory Team discovered SQL injection vulnerability in ES Job Search Engine v3.0
|
||
|
||
|
||
Report-Timeline:
|
||
================
|
||
2011-08-09: Public Disclosure
|
||
|
||
|
||
Status:
|
||
========
|
||
Published
|
||
|
||
|
||
Affected Products:
|
||
==================
|
||
ES
|
||
Product: Job Search Engine v3.0
|
||
|
||
|
||
Exploitation-Technique:
|
||
=======================
|
||
Remote
|
||
|
||
|
||
Severity:
|
||
=========
|
||
Critical
|
||
|
||
|
||
Details:
|
||
========
|
||
A SQL Injection vulnerability is detected in the ES Job Search Engine v3.0 Web Application.
|
||
Remote attackers without access privileges can execute/inject own sql commands to compromise
|
||
the search engine dbms. The vulnerability is located in the listing modules with bounded vulnerable
|
||
category parameter. Successful exploitation of the remote sql injection vulnerability result in dbms
|
||
or web application compromise. Exploitation requires no privileged user account.
|
||
|
||
Vulnerable Module(s):
|
||
[+] ../category/3[>
|
||
|
||
|
||
Proof of Concept:
|
||
=================
|
||
The sql injection vulnerability can be exploited by remote attackers without privileged application user account.
|
||
User inter action is not required to exploit the vulnerability. For demonstration or reproduce ...
|
||
|
||
PoC:
|
||
http://[SERVER]/projects/[PATH]/light/category/-1'+union+select+1,group_concat(table_name)+from+information_schema.tables+where+table_schema=database()--%20-
|
||
|
||
|
||
Risk:
|
||
=====
|
||
The security risk of the remote sql injection vulnerability is estimated as critical.
|
||
|
||
|
||
|
||
Credits:
|
||
========
|
||
Vulnerability Laboratory [Research Team] - Ibrahim El-Sayed [storm] (strom@vulnerability-lab.com)
|
||
|
||
|
||
|
||
Disclaimer:
|
||
===========
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
|
||
Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com
|
||
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright © 2012 | Vulnerability Laboratory
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY RESEARCH LABORATORY
|
||
LABORATORY RESEARCH TEAM
|
||
CONTACT: research@vulnerability-lab.com |