WordPress Plugin Enable Media Replace – Multiple Vulnerabilities
PRODUCT NAME: Enable Media Replace WordPress Plugin PRODUCT URL 1: http://wordpress.org/extend/plugins/enable-media-replace/ PRODUCT URL 2: http://mansjonasson.se/wordpress-plugins/enable-media-replace/ PRODUCT AUTHOR: Mans Jonasson for .SE (Stiftelsen for Internetinfrastruktur) -- http://www.iis.se/ SECURITY RESEARCHER: Ulf Harnhammar -- http://thcxthcx.net/ AFFECTED VERSIONS: 2.3 and probably all prior versions STATUS: Unpatched. Mans was contacted on 30 Jan and 3 Feb, but he is very busy with other things than maintaining this plugin. SOLUTION: Deactivate the plugin temporarily. Look for other plugins that will help you with the media handling. IMPACT: Information retrieval and manipulation, arbitrary code execution VULNERABILITY DETAILS: 1) A user can perform SQL Injection attacks against the plugin at the Replace Media Upload page (Media > Edit > Upload a new file). By changing the "attachment_id" parameter in the URL to: attachment_id=99999+union+select+concat(0x20,user_login),+user_pass+from+wp_users+where+ID=1 .. the plugin will retrieve and display the administrator's user name and password hash. This requires that the attacker has knowledge of the SQL table prefix, but that can be retrieved as well from information_schema.TABLES . NOTE: There are other SQL Injection bugs in the plugin code base, but it is currently not known if they pose a security threat. 2) A user can upload arbitrary files, including PHP files, at the Replace Media Upload page using the "Replace the file" functionality, which doesn't check if uploaded files have an allowed extension. This can be exploited to execute arbitrary PHP code and for instance retrieve or change sensitive information in the SQL database or the web server's file system. Both issues require that the attacker has a valid user on the WordPress system with Author or higher permissions. Therefore the vulnerabilities will have more of an impact in large organisations with more users than in small organisations with fewer users. // Ulf Harnhammar |