WordPress CevherShare 2.0 plugin SQL Injection Vulnerability

vendor:

CevherShare

by:

bd0rk

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: CevherShare

Affected Version From: 2

Affected Version To: 2

Patch Exists: YES

Related CWE: N/A

CPE: a:phpkode:cevhershare

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu-Linux

2013

WordPress CevherShare 2.0 plugin SQL Injection Vulnerability

The WordPress CevherShare 2.0 plugin is vulnerable to a SQL Injection vulnerability due to insufficient sanitization of user-supplied input in the 'id' parameter of the 'cevhershare-admin.php' script. An attacker can exploit this vulnerability to execute arbitrary SQL commands on the underlying database, allowing for the manipulation or disclosure of arbitrary data.

Mitigation:

The vendor has released an update to address this vulnerability. Users are advised to update to the latest version of the plugin.

Source

Exploit-DB raw data:

=> WordPress CevherShare 2.0 plugin SQL Injection Vulnerability

=> Bugfounder: bd0rk

=> Contact: bd0rk[at]hackermail.com

=> Greetings: Perle, Martin K., Carsten R., x0r_32

=> Affected-Software: WordPress CevherShare 2.0 plugin

=> Vendor: http://phpkode.com/

=> Download: http://phpkode.com/download/s/cevhershare.zip

=> Tested on: Ubuntu-Linux

Vulnerable C0de in cevhershare/cevhershare-admin.php

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

PoC: http://[someone]/wp-content/plugins/cevhershare/cevhershare-admin.php?id=[SQL-Injection]

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
$id = $_GET['id'] ? $_GET['id'] : $_POST['id'];
	$pos = $_GET['pos'] ? $_GET['pos'] : $_POST['pos'];
	$status = $_GET['status'] ? $_GET['status'] : $_POST['status'];
	$task = $_GET['t'] ? $_GET['t'] : $_POST['t'];
	$do = $_POST['do'];
	if($do == "update-lang"){
		$uplang = $_POST['update-lang'];
		update_option('cevhershare_language',$uplang);
	}
	if($id)	$item = $wpdb->get_row("SELECT * FROM ".$wpdb->prefix."cevhershare WHERE id=$id");
	if($do == 'update') $wpdb->query("UPDATE ".$wpdb->prefix."cevhershare SET enabled='".$_POST['enabled']."', position='".$_POST['position']."', name='".$_POST['name']."', big='".$_POST['big']."', small='".$_POST['small']."' WHERE id='$id'");
	elseif($do == 'add') $wpdb->query("INSERT INTO ".$wpdb->prefix."cevhershare (position, name, big, small) VALUES('".$_POST['position']."','".$_POST['name']."', '".$_POST['big']."', '".$_POST['small']."')");
	elseif($do == 'delete') $wpdb->query("DELETE FROM ".$wpdb->prefix."cevhershare WHERE id=$id LIMIT 1");
	elseif($do == 'reset') cevhershare_reset();
	elseif($do == 'settings'){

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++



Greetings from cold Germany, bd0rk. :-)