JetSınav SQL Injection + Default Password Vulnerability

2023.05.28

BQX (TR)

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: N/A

Dork: allintext:"Powered by Jetsınav"

Dork: allintext:"Powered by Jetsınav"
admin panel:/admin/login.php

in script 2 vuln

1)Default Password
2)SQL Injection

Default Password poc: 
dork in google search>select site

email: demo@demo.com
pass: demo (or) demox

SQL Injection poc:
select site and search id  
ex: haber.php?id=5 

no md5 hash no encrypt

BONUS - EXAMPLE
Admin Panel
Panel: https://onlinebasari.com/admin/login.php
E-Mail:demo@demo.com
Şifre:demox

Webmail
Kullanıcı adı:  noreply@onlinebasari.com
Şifre:  onlinebasari.com
Webmail Panel: https://onlinebasari.com/webmail
Sunucu:  https://mail.onlinebasari.com:2080
Port: 2080

References:

t.me/zerotolerance_hack

See this note in RAW Version

Vote for this issue:

38%

62%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

JetSınav SQL Injection + Default Password Vulnerability

Dork: allintext:"Powered by Jetsınav"

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.