CVE-2010-2611
Description
SQL injection vulnerability in show_search_result.php in i-netsolution Job Search Engine allows remote attackers to execute arbitrary SQL commands via the keyword parameter.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
i-netsolution Job Search Engine - SQL Injection
1 ########################################## 1
0 I'm Sid3^effects member from Inj3ct0r Team 1
1 ########################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
Vendor Url : http://www.i-netsolution.com/
Google Dork: inurl:/jobsearchengine/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz
#######################################################################################################
Description:
i Net job search engine script eliminates your worry about searching for an employer. Because our search engine software is an extensive and powerful script written in PHP, thus enabling you to launch your own jobs search portal. It has a potential to fix results from 300 major jobsites in 18 countries & thereby indexing nearly 80,000 jobs per day. This fixed list can be indexed by category, location, positions or relevance. Additionally it can also be utilized as a job site. We provide you with the newest features of major employment sites out there. It also helps the back office for the administrators providing full control over the website, structure and content management, detailed user management, statistics and many more. Our job search script is built with a focus on increased ease for users and webmasters together. Get rid of worrying about your competitors, since fixing 80,000 new pages every day from major employment sites.
#######################################################################################################
Xploit: SQLi VUlnerability
DEMO URL : http://server/jobsearchengine/show_search_result.php?keyword=[sqli]
###############################################################################################################
# 0day no more
# Sid3^effects Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| i-netsolution | job_search_engine_script | | |
References
- http://packetstormsecurity.org/1006-exploits/inetsolutionjobsearch-sql.txt
- http://www.exploit-db.com/exploits/14079
- http://www.vupen.com/english/advisories/2010/1625
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59777
- http://packetstormsecurity.org/1006-exploits/inetsolutionjobsearch-sql.txt
- http://www.exploit-db.com/exploits/14079
- http://www.vupen.com/english/advisories/2010/1625
- https://exchange.xforce.ibmcloud.com/vulnerabilities/59777
CWEs
CWE-89
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.