what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress Analytics Stats Counter Statistics 1.2.2.5 PHP Object Injection

WordPress Analytics Stats Counter Statistics 1.2.2.5 PHP Object Injection
Posted Mar 1, 2017
Authored by Yorick Koster, Securify B.V.

WordPress Analytics Stats Counter Statistics plugin version 1.2.2.5 suffers from a PHP object injection vulnerability.

tags | advisory, php
SHA-256 | d1935f94c13d237a769e00666940587d42964a0f386dbc6ac59063ea3b38e413

WordPress Analytics Stats Counter Statistics 1.2.2.5 PHP Object Injection

Change Mirror Download
------------------------------------------------------------------------
Analytics Stats Counter Statistics WordPress Plugin unauthenticated PHP
Object injection vulnerability
------------------------------------------------------------------------
Yorick Koster, June 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A PHP Object injection vulnerability was found in the Analytics Stats
Counter Statistics WordPress Plugin, which can be used by an
unauthenticated user to instantiate arbitrary PHP Objects. Using this
vulnerability it is possible to execute arbitrary PHP code.

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160803-0005

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on the Analytics Stats Counter
Statistics WordPress Plugin version 1.2.2.5.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
There is currently no fix available.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/analytics_stats_counter_statistics_wordpress_plugin_unauthenticated_php_object_injection_vulnerability.html

This issue is possible due to an unsafe call to unserialize() in the wpadm_unpack() method. The input is taken directly from the POST request as can be seen in the following code fragment:

wpadm.php:

if ( ! function_exists( 'wpadm_run' )) {
function wpadm_run($pl, $dir) {
@set_time_limit(0);
require_once dirname(__FILE__) . '/class-wpadm-method-class.php';
$request_name = 'wpadm_'.$pl.'_request';
if( isset( $_POST[$request_name] ) && ! empty ( $_POST[$request_name] ) ) {
require_once dirname(__FILE__) . '/class-wpadm-core.php';
$wpadm = new WPAdm_Core(wpadm_unpack($_POST[$request_name]), $pl, $dir);
echo '<wpadm>'.wpadm_pack($wpadm->getResult()->toArray()).'</wpadm>';
exit;
}
}
}


if ( ! function_exists( 'wpadm_unpack' )) {
/**
* @param str $str
* @return mixed
*/
function wpadm_unpack( $str ) {
return unserialize( base64_decode( $str ) );
}
}

It has been confirmed that this issues can be used to execute arbitrary PHP code.


------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.

Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    0 Files
  • 4
    Oct 4th
    0 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close