WordPress Plugin cp-multi-view-calendar 1.1.4 – SQL Injection

• Exploit Database
• 103 阅读

• 作者： i0akiN SEC-LABORATORY
  日期： 2015-03-03
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/36243/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73

  # Exploit Title: WordPress: cp-multi-view-calendar.1.1.4[SQL Injection vulnerabilities] # Date: 2015-02-28 # Google Dork: Index of /wordpress/wp-content/plugins/cp-multi-view-calendar # Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ] # Vendor Homepage: http://wordpress.dwbooster.com/ # Software Link: https://downloads.wordpress.org/plugin/cp-multi-view-calendar.1.1.4.zip # Version: 1.1.5 # Tested on: windows 7 ultimate + sqlmap 0.9. It's php aplication # OWASP Top10: A1-Injection # Mitigations: Upgrade to version 1.1.5   Greetz to Christian Uriel Mondragon Zarate   Video demo of unauthenticated user sqli explotation vulnerability :       ###################################################################   ADMIN PAGE SQL INJECTION -------------------------------------------------   http://localhost/wordpress/wp-admin/admin-ajax.php?action=ajax_add_calendar   sqlinjection in post parameter viewid   -------------------------------------------------------------------   http://localhost/wordpress/wp-admin/admin-ajax.php?action=ajax_delete_calendar   sqlinjection in post parameter id     ########################################   UNAUTENTICATED SQL INJECTION -----------------------------------------------------------------   http://localhost/wordpress/?action=data_management&cpmvc_do_action=mvparse&f=edit&id=1   sql injection in id parameter   -----------------------------------------------------------------------   http://localhost/wordpress/?action=data_management&cpmvc_do_action=mvparse&f=datafeed&method=list&calid=1   datapost viewtype=list&list_order=asc vuln variable list_order     ################################################################   CROSSITE SCRIPTING VULNERABILITY ----------------------------------------------------------   http://localhost/wordpress/?action=data_management&cpmvc_do_action=mvparse&weekstartday=alert(12)&f=edit&id=1   crosite script weekstartday parameter   ###################################################   ==================================   time-line   26-02-2015: vulnerabilities found 27-02-2015: reported to vendor 28-02-2015: release new cp-multi-view-calendar version 1.1.4 28-02-2015: full disclousure   ===================================