CVE-2012-10009 (published 2023-03-21T00:15Z)

A vulnerability was found in 404like Plugin up to 1.0.2 on WordPress. It has been classified as critical. Affected is the function checkPage of the file 404Like.php. The manipulation of the argument searchWord leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 1.0.2 is able to address this issue. The name of the patch is 2c4b589d27554910ab1fd104ddbec9331b540f7f. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-223404.

CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-89
cwe_name: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
extended_description: 
            
            
         
         

Fix information:
repo_url: https://github.com/wp-plugins/404like
commit_details: repo_url: https://github.com/wp-plugins/404like
author: tobig
author_date: 2012-02-11 22:24:01+00:00
msg: Check for sql injection by '";
Plugin work automatic without code in 404 template

git-svn-id: https://plugins.svn.wordpress.org/404like/trunk@503776 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/404like
repo_name: wp-plugins/404like
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: 404Like.php
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
  Plugin Name: 404Like
  Plugin URI: http://www.gnetos.de/projekte/404Like
  Description: Es wird keine 404 Fehlermeldung ausgegeben, sondern nach hnlichen Seiten gesucht und auf eventuelle Treffer weitergeleitet oder eine Liste mglicher Treffer ausgegeben / It is not issued any 404 error message, but looking for similar sites and forwarded to any results or output a list of possible matches
- Version: 1.0
+ Version: 1.0.2
  Author: Tobias Gafner
  Author URI: http://www.gnetos.de
  License: GPL2
@@ -28,16 +28,18 @@ Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  * Search function
  */ 
 function findPostWhereLikeNameTitle($title = "") {
+	$title = strtolower($title);
 	$where .= " (post_type = 'post' OR post_type = 'page') AND
-    post_status = 'publish' AND (post_name like '%".$title."%' OR post_title like '%".$title."%')";
+    post_status = 'publish' AND (LOWER(post_name) like '%".$title."%' OR post_title like '%".$title."%')";
 	return $where;
 }
 /**
  * Search function
  */ 
 function findPostWhereLike($title = "") {
+	$title = strtolower($title);
 	$where = " (post_type = 'post' OR post_type = 'page') AND
-    post_status = 'publish' AND (post_title like '%".$title."%')";
+    post_status = 'publish' AND (LOWER(post_title) like '%".$title."%')";
 	return $where;
 }
 /**
@@ -52,11 +54,15 @@ function findPostWhereLike($title = "") {
  */  
 function checkPage() {
 	global $wpdb;
+	
+	if ( !is_404() )
+	return;
 
   $urltext =  $_SERVER['REQUEST_URI'];
 	//$urltexta = substr($urltext,1);
 	$urltext = trim($urltext);
   //Letztes / loeschen
+  //schuetzen
   $urltext = htmlspecialchars($urltext); 
   if(strlen($urltext) != 0)   {
     //Letztes Zeichen ist ?
@@ -66,16 +72,22 @@ function checkPage() {
     //Letztes von xxx/xxxx/xxx ist interessant
     $searchWord = 	substr (strrchr ($urltext, "/"), 1);
     //SQL 
+    $searchWord = stripslashes($searchWord);
+    $searchWord = str_replace ("'", "", $searchWord);
+    $searchWord = str_replace ('"', "", $searchWord);
+    $searchWord = str_replace (';', "", $searchWord);
     $querystr = "SELECT * FROM $wpdb->posts WHERE ".findPostWhereLike($searchWord);
     $pageposts = $wpdb->get_col($querystr);
     if ($pageposts) {
       ob_start();
-  		if (count($pageposts) == 1) { 
+      
+  		if (count($pageposts) == 1 || ($searchWord == "404Like" || $searchWord == "404like")) { 
       	foreach ($pageposts as $id) {
           $url = get_permalink($id); 
           echo $inhalt;
           wp_redirect($url,301);
           // Okay, stop.
+          break;
         }         
         
         wp_reset_query();               
@@ -112,7 +124,7 @@ function new404ErrorPage() {
     $pageposts = $wpdb->get_col($querystr);
     if ($pageposts) {
     //Ausgabe
-      echo '<div id="errorresults"><h2 class="twost">Folgendes Gesucht ?</h2><ul>';
+      echo '<div id="errorresults"><h2 class="twost">'.__("Folgendes Gesucht").' ?</h2><ul>';
     	foreach ($pageposts as $id) {
         $post_id_7 = get_post($id);
         $url = get_permalink($id);  
@@ -125,4 +137,13 @@ function new404ErrorPage() {
   	wp_reset_query();
 	}
 }
+
+function plugin404Like_filter($redirect, $request) {
+
+	if ( is_404() ) {return false;}
+	return $redirect;
+}
+
+add_action( 'template_redirect', 'checkPage' );
+add_filter( 'redirect_canonical', 'plugin404Like_filter', 10, 2 );
 ?>
\ No newline at end of file

programming_language: PHP
filename: readme.txt
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@ Contributors: tobig
 Donate link: http://www.gnetos.de
 Tags: 404, not found
 Requires at least: 2.7.0
-Tested up to: 3.0
+Tested up to: 3.3.0
 Stable tag: trunk
 
 It is not issued any 404 error message, but looking for similar sites and forwarded to any results or output a list of possible matches
@@ -16,5 +16,5 @@ It is not issued any 404 error message, but looking for similar sites and forwar
 
 1. Upload `404Like.php` to the `/wp-content/plugins/` directory
 2. Activate the plugin through the 'Plugins' menu in WordPress
-3. Place `<?php checkPage(); ? >` in first line of your 404 template page.
+3. Nothing, it works without any other activities - you can test it
 4. Optional add < ? php new404ErrorPage(); ? >  to your 404 template page.
\ No newline at end of file

programming_language: Markdown