WordPress Plugin CP Multi View Event Calendar 1.1.7 – SQL Injection

• Exploit Database
• 107 阅读

• 作者： i0akiN SEC-LABORATORY
  日期： 2015-07-10
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/37560/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88

  # Exploit Title: WordPress cp-multi-view-calendar.1.1.7[Unauthenticated SQL injection vulnerabilities] # Date: 2015-07-10 # Google Dork: Index of /wordpress/wp-content/plugins/cp-multi-view-calendar # Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ] # Vendor Homepage: http://wordpress.dwbooster.com/ # Software Link: https://downloads.wordpress.org/plugin/cp-multi-view-calendar.1.1.7.zip # Version: 1.1.7 # Tested on: windows 7 + sqlmap 0.9. # OWASP Top10: A1-Injection     ==================== DESCRIPTION ====================   Multiple SQL Injection vulnerabilities has been detected in the WordPress cp-multi-view-calendar plugin in version 1.1.7 . The vulnerability allows remote attackers to inject own sql commands to compromise the affected web-application and connected dbms.   The SQL Injection vulnerabilities are located in the <code>edit.php</code> and <code>datafeed.php</code> files. Remote attackers are able to inject own sql commands to the vulnerable parameters value in these files GET/POST method request.   The remote sql injection web vulnerability can be exploited by remote attackers without privileged application user account and without required user interaction. Successful exploitation of the sql injection vulnerability results in application and web-service or dbms compromise.   =================== Severity Level =================== Critical     ================================= AFFECTED URLs AND PARAMETER(S) =================================   http://localhost/wordpress/?action=data_management&cpmvc_do_action=mvparse&f=edit&id=[SQLi]   Vulnerable parameter: <code>id Explotation technique: blind (time-based) , union query based.   -------------------------------------------------------------------   http://localhost/wordpress/?action=data_management&cpmvc_do_action=mvparse&f=datafeed&method=remove&rruleType=del_only&calendarId=[SQLi]   Vulnerable parameter: <code>calendarId Explotation technique: blind (boolean based, time based), error based.   -----------------------------------------------------------------------   http://localhost/wordpress/?action=data_management&cpmvc_do_action=mvparse&f=datafeed&method=adddetails&id=1&calid=[SQLi]   Vulnerable parameter: <code>calid Explotation technique: blind (boolean based, time based)   -----------------------------------------------------------------------     it isn&apos;t all sqli vulnerabilities, but these are the vulnerable functions:     In file datafeed.php   -checkIfOverlapping(...) -updateDetailedCalendar(...) -removeCalendar(...)     In file edit.php -getCalendarByRange(...)     ... I think this is all..     Sorry. I didn&apos;t have much time for this report.   ==================================   time-line   2015-07-01: vulnerabilities found 2015-07-09: reported to vendor 2015-07-10: 2015-07-12:   ===================================