SEC Consult Vulnerability Lab Security Advisory < 20110701-0 >
======================================================================= |
title: Multiple SQL Injection Vulnerabilities |
vulnerable version: 3.1.3/3.2-RC1 and probably earlier versions |
fixed version: 3.1.4/3.2-RC3 |
homepage: http://wordpress.org/ |
SEC Consult Vulnerability Lab |
https://www.sec-consult.com |
======================================================================= |
"WordPress was born out of a desire for an elegant, well-architectured |
personal publishing system built on PHP and MySQL and licensed under |
the GPLv2 (or later). It is the official successor of b2/cafelog. |
WordPress is fresh software, but its roots and development go back to |
Source: http://wordpress.org/about/ |
Vulnerability overview/description: |
----------------------------------- |
Due to insufficient input validation in certain functions of WordPress |
it is possible for a user with the "Editor" role to inject arbitrary |
SQL commands. By exploiting this vulnerability, an attacker gains |
access to all records stored in the database with the privileges of the |
1) The get_terms() filter declared in the wp-includes/taxonomy.php file |
does not properly validate user input, allowing an attacker with |
"Editor" privileges to inject arbitrary SQL commands in the "orderby" |
and "order" parameters passed as array members to the vulnerable filter |
when sorting for example link categories. |
The following URLs could be used to perform blind SQL injection |
http://localhost/wp-admin/edit-tags.php?taxonomy=link_category&orderby=[SQL |
injection]&order=[SQL injection] |
http://localhost/wp-admin/edit-tags.php?taxonomy=post_tag&orderby=[SQL |
injection]&order=[SQL injection] |
http://localhost/wp-admin/edit-tags.php?taxonomy=category&orderby=[SQL |
injection]&order=[SQL injection] |
2) The get_bookmarks() function declared in the |
wp-includes/bookmark.php file does not properly validate user input, |
allowing an attacker with "Editor" privileges to inject arbitrary SQL |
commands in the "orderby" and "order" parameters passed as array |
members to the vulnerable function when sorting links. |
The following URL could be used to perform blind SQL injection attacks: |
http://localhost/wp-admin/link-manager.php?orderby=[SQL |
injection]&order=[SQL injection] |
Vulnerable / tested versions: |
----------------------------- |
The vulnerability has been verified to exist in version 3.1.3 of |
WordPress, which is the most recent version at the time of discovery. |
2011-06-22: Contacting vendor through security () wordpress org |
2011-06-22: Vendor reply, sending advisory draft |
2011-06-23: Vendor confirms security issue |
2011-06-30: Vendor releases patched version |
2011-07-01: SEC Consult publishes advisory |
Upgrade to version 3.1.4 or 3.2-RC3 |
A more restrictive role, e.g. "Author", could be applied to the user. |
https://www.sec-consult.com/en/advisories.html |
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ |
SEC Consult Unternehmensberatung GmbH |
Tel.: +43 / 1 / 890 30 43 - 0 |
Fax.: +43 / 1 / 890 30 43 - 25 |
Mail: research at sec-consult dot com |
https://www.sec-consult.com |
EOF K. Gudinavicius / @2011
Fonte: http://www.exploit-db.com/exploits/17465/