i-netsolution Job Search Engine 'show_search_result.php'SQL注入漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1119564 漏洞类型 SQL注入
发布时间 2010-06-27 更新时间 2010-07-02
CVE编号 CVE-2010-2611 CNNVD-ID CNNVD-201007-015
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/14079
https://www.securityfocus.com/bid/73748
https://cxsecurity.com/issue/WLB-2010070173
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-201007-015
|漏洞详情
i-netsolutionJobSearchEngine中脚本show_search_result.php存在SQL注入漏洞,远程攻击者可以通过keyword参数执行任意SQL指令。
|漏洞EXP
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Vendor Url : http://www.i-netsolution.com/
Google Dork: inurl:/jobsearchengine/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################

Description:
  	i Net job search engine script eliminates your worry about searching for an employer. Because our search engine software is an extensive and powerful script written in PHP, thus enabling you to launch your own jobs search portal. It has a potential to fix results from 300 major jobsites in 18 countries & thereby indexing nearly 80,000 jobs per day. This fixed list can be indexed by category, location, positions or relevance. Additionally it can also be utilized as a job site. We provide you with the newest features of major employment sites out there. It also helps the back office for the administrators providing full control over the website, structure and content management, detailed user management, statistics and many more. Our job search script is built with a focus on increased ease for users and webmasters together. Get rid of worrying about your competitors, since fixing 80,000 new pages every day from major employment sites. 


#######################################################################################################

Xploit: SQLi VUlnerability


DEMO URL : http://server/jobsearchengine/show_search_result.php?keyword=[sqli]

###############################################################################################################
# 0day no more 
# Sid3^effects
|受影响的产品
I-Netsolution Job Search Engine Script 0
|参考资料

来源:XF
名称:inetjobsearch-showsearchresult-sql-injection(59777)
链接:http://xforce.iss.net/xforce/xfdb/59777
来源:VUPEN
名称:ADV-2010-1625
链接:http://www.vupen.com/english/advisories/2010/1625
来源:EXPLOIT-DB
名称:14079
链接:http://www.exploit-db.com/exploits/14079
来源:MISC
链接:http://packetstormsecurity.org/1006-exploits/inetsolutionjobsearch-sql.txt