发布 2015-11-11 漏洞条目

WordPress Plugin WP Fastest Cache 0.8.4.8 – Blind SQL Injection

Exploit Source

# Exploit Title: WP Fastest Cache 0.8.4.8 Blind SQL Injection

# Date: 11-11-2015

# Software Link: https://wordpress.org/plugins/wp-fastest-cache/

# Exploit Author: Kacper Szurek

# Contact: http://twitter.com/KacperSzurek

# Website: http://security.szurek.pl/

# Category: webapps

1. Description

For this vulnerabilities also WP-Polls needs to be installed.

Everyone can access wpfc_wppolls_ajax_request().

$_POST["poll_id"] is not escaped properly.

File: wp-fastest-cache\inc\wp-polls.php

public function wpfc_wppolls_ajax_request() {

$id = strip_tags($_POST["poll_id"]);

$id = mysql_real_escape_string($id);

$result = check_voted($id);

if($result){

echo "true";

}else{

echo "false";

}

die();

}

http://security.szurek.pl/wp-fastest-cache-0848-blind-sql-injection.html

2. Proof of Concept

</form>

3. Solution:

Update to version 0.8.4.9

相关漏洞条目