WordPress Enable Media Replace Plugin SQL Injection and Arbitrary File Upload Vulnerabilities
BID:46286
Info
WordPress Enable Media Replace Plugin SQL Injection and Arbitrary File Upload Vulnerabilities
| Bugtraq ID: | 46286 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 09 2011 12:00AM |
| Updated: | Feb 09 2011 12:00AM |
| Credit: | Ulf Harnhammar |
| Vulnerable: |
WordPress Enable Media Replace 2.3 |
| Not Vulnerable: | |
Discussion
WordPress Enable Media Replace Plugin SQL Injection and Arbitrary File Upload Vulnerabilities
The Enable Media Replace plug-in for WordPress is prone to an SQL-injection vulnerability and an arbitrary-file-upload vulnerability because it fails to sanitize user-supplied data.
Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.
Enable Media Replace 2.3 is vulnerable; other versions may also be affected.
The Enable Media Replace plug-in for WordPress is prone to an SQL-injection vulnerability and an arbitrary-file-upload vulnerability because it fails to sanitize user-supplied data.
Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.
Enable Media Replace 2.3 is vulnerable; other versions may also be affected.
Exploit / POC
WordPress Enable Media Replace Plugin SQL Injection and Arbitrary File Upload Vulnerabilities
An attacker can use a browser to exploit these issues.
The following example URI is available:
http://www.example.com/attachment_id=99999+union+select+concat(0x20,user_login),+user_pass+from+wp_users+where+ID=1
An attacker can use a browser to exploit these issues.
The following example URI is available:
http://www.example.com/attachment_id=99999+union+select+concat(0x20,user_login),+user_pass+from+wp_users+where+ID=1
Solution / Fix
WordPress Enable Media Replace Plugin SQL Injection and Arbitrary File Upload Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
WordPress Enable Media Replace Plugin SQL Injection and Arbitrary File Upload Vulnerabilities
References:
References:
- Wordpress Enable Media Replace Plugin Homepage (Wordpress)
- WordPress Homepage (WordPress)