WordPress Users Ultra Plugin [Blind SQL injection]
One can perform an SQL injection attack simply by exploiting the following WP ajax actions: edit_video, delete_photo, delete_gallery, delete_video, reload_photos, edit_gallery, edit_gallery_confirm, edit_photo, edit_photo_confirm, edit_video_confirm, set_as_main_photo, sort_photo_list, sort_gallery_list, reload_videos. POST parameters that are exploitable in each action respectively: video_id, photo_id, gal_id, video_id, gal_id, gal_id, gal_id, photo_id, photo_id, video_id, photo_id, gal_id, order, order, video_id. In case #7 a user can also change the gallery name, description and visibility by setting POST parameters gal_name, gal_desc and gal_visibility respectively. In case #8 photo_id is first casted to integer and a query to DB is performed. If results are returned then for each result a new query is performed without casting the photo_id to integer. So if an attacker knows a valid video id then it can perform the attack in the second query. This achievable because <?php (int)'1 and sleep(5)' === 1; ?>. In case #9 a user can also change the photo name, description, tags and category by setting POST parameters photo_name, photo_desc, photo_tags and photo_category respectively. In case #10 a user can also change the video name, unique id and type by setting POST parameters video_name, video_unique_id and video_type respectively.
