exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress NOSpamPTI 2.1 Blind SQL Injection

WordPress NOSpamPTI 2.1 Blind SQL Injection
Posted Sep 20, 2013
Authored by Alexandro Silva

WordPress NOSpamPTI plugin version 2.1 suffers from a remote blind SQL injection vulnerability.

tags | exploit, remote, sql injection
advisories | CVE-2013-5917
SHA-256 | 58aa4142de2233611890f47f72f2972f2c389dd1fa2abe3fb8100667a4fc03fe

WordPress NOSpamPTI 2.1 Blind SQL Injection

Change Mirror Download
[ NOSpamPTI Wordpress plugin Blind SQL Injection ]

[ Vendor product description ]

NOSpamPTI eliminates the spam in your comment box so strong and free,
developed from the idea of Nando Vieira <a href="http://bit.ly/d38gB8"
rel="nofollow">http://bit.ly/d38gB8</a>, but some themes do not support
changes to the functions.php to this we alter this function and
available as a plugin. Make good use of this plugin and forget all the Spam.

[ Bug Description ]

NOSpamPTI contains a flaw that may allow an attacker to carry out a
Blind SQL injection attack. The issue is due to the wp-comments-post.php
script not properly sanitizing the comment_post_ID in POST data. This
may allow an attacker to inject or manipulate SQL queries in the
back-end database, allowing for the manipulation or disclosure of
arbitrary data.

[ History ]

Advisory sent to vendor on 09/09/2013
Vendor reply 09/20/2013. According the vendor, the plugin was deprecated.

[ Impact ]

HIGH

[ Afected Version ]

2.1

[ CVE Reference]

CVE-2013-5917

[ POC ]

Payload:
POST /wordpress/wp-comments-post.php

author=1&challenge=1&challenge_hash=e4da3b7fbbce2345d7772b0674a318d5&comment=1&comment_parent=0&comment_post_ID=1
AND SLEEP(5)&email=sample@email.tst&submit=Post Comment&url=1

[ Vulnerable code ]

$post_id = $_POST['comment_post_ID'];

load_plugin_textdomain('nospampti',
WP_PLUGIN_URL.'/nospampti/languages/', 'nospampti/languages/');

if ($hash != $challenge) {
$wpdb->query("DELETE FROM {$wpdb->comments} WHERE comment_ID =
{$comment_id}");
$count = $wpdb->get_var("select count(*) from $wpdb->comments
where comment_post_id = {$post_id} and comment_approved = '1'");


[ Reference ]

[1] No SpamPTI SVN repository -
http://plugins.svn.wordpress.org/nospampti/trunk/nospampti.php
[2] Owasp - https://owasp.org/index.php/SQL_Injection
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/

--------------------------------------------
iBliss Segurança e InteligĂȘncia - Sponsor: Alexandro Silva - Alexos

alexos (at) ibliss.com (dot) br [email concealed]
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    17 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    7 Files
  • 23
    May 23rd
    111 Files
  • 24
    May 24th
    27 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    6 Files
  • 28
    May 28th
    12 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close