Word Press SQL Injection ( in myLDlinker.php Plugin )

vendor:

WordPress

by:

H-SK33PY

8,8

CVSS

HIGH

SQL Injection

CWE

Product Name: WordPress

Affected Version From: 2.9.2

Affected Version To: 2.9.2

Patch Exists: NO

Related CWE: N/A

CPE: a:wordpress:wordpress

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2010

Word Press SQL Injection ( in myLDlinker.php Plugin )

After find plugin at sites run SQL Inject : example : http://site.com/myLDlinker.php?url=18[SQLi]

Mitigation:

Ensure that user input is validated and filtered before being used in SQL queries.

Source

Exploit-DB raw data:

   010101010101010101010101010101010101010101010101010101010    
   0                                                       0
   1  Iranian Datacoders Security Team 2010
   0                                                       0
   010101010101010101010101010101010101010101010101010101010


# Exploit Title: Word Press SQL Injection ( in myLDlinker.php Plugin )                   
# Date: 23/07/2010                             
# Author: H-SK33PY                      
# Software Link: http://www.wordpress.com/
# Version: 2.9.2
# Google dork :inurl:"myLDlinker.php"
# Platform / Tested on: linux
# Category: Expliot code
# Code : [SQLi]

#BUG:#########################################################################

After find plugin at sites run SQL Inject :


example : http://site.com/myLDlinker.php?url=18[SQLi]


#############################################################################
Website : http://www.datacoders.ir

Special Thanks to : ccC0d3rZzz & AGT & all iranian datacoders members

#############################################################################