36 lines
No EOL
2.1 KiB
Text
36 lines
No EOL
2.1 KiB
Text
PRODUCT NAME: Enable Media Replace WordPress Plugin
|
|
PRODUCT URL 1: http://wordpress.org/extend/plugins/enable-media-replace/
|
|
PRODUCT URL 2: http://mansjonasson.se/wordpress-plugins/enable-media-replace/
|
|
PRODUCT AUTHOR: Mans Jonasson for .SE (Stiftelsen for Internetinfrastruktur) -- http://www.iis.se/
|
|
SECURITY RESEARCHER: Ulf Harnhammar -- http://thcxthcx.net/
|
|
AFFECTED VERSIONS: 2.3 and probably all prior versions
|
|
STATUS: Unpatched. Mans was contacted on 30 Jan and 3 Feb, but he is very busy with other
|
|
things than maintaining this plugin.
|
|
SOLUTION: Deactivate the plugin temporarily. Look for other plugins that will help you with
|
|
the media handling.
|
|
IMPACT: Information retrieval and manipulation, arbitrary code execution
|
|
|
|
VULNERABILITY DETAILS:
|
|
|
|
1) A user can perform SQL Injection attacks against the plugin at the Replace Media Upload page
|
|
(Media > Edit > Upload a new file). By changing the "attachment_id" parameter in the URL to:
|
|
|
|
attachment_id=99999+union+select+concat(0x20,user_login),+user_pass+from+wp_users+where+ID=1
|
|
|
|
.. the plugin will retrieve and display the administrator's user name and password hash. This
|
|
requires that the attacker has knowledge of the SQL table prefix, but that can be retrieved as
|
|
well from information_schema.TABLES .
|
|
|
|
NOTE: There are other SQL Injection bugs in the plugin code base, but it is currently not known if they
|
|
pose a security threat.
|
|
|
|
2) A user can upload arbitrary files, including PHP files, at the Replace Media Upload page using the
|
|
"Replace the file" functionality, which doesn't check if uploaded files have an allowed extension. This
|
|
can be exploited to execute arbitrary PHP code and for instance retrieve or change sensitive
|
|
information in the SQL database or the web server's file system.
|
|
|
|
Both issues require that the attacker has a valid user on the WordPress system with Author or higher
|
|
permissions. Therefore the vulnerabilities will have more of an impact in large organisations with
|
|
more users than in small organisations with fewer users.
|
|
|
|
// Ulf Harnhammar |