--mxv5cy4qt+RJ9ypb
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
On Sat, Jun 29, 2013 at 03:02:37PM +0000, iedb.team@gmail.com wrote:
> # Exploit Title : Wordpress wp-private-messages Plugin Sql Injection vuln=
erability
> # Software Link : http://wordpress.org/plugins/wp-private-messages/
>=20
> # http://www.Site.com/wp-admin/profile.php?page=3Dwp-private-messages/wpu=
_private_messages.php&wpu=3Dreply&msgid=3D[Sql]
Could not reproduce. Could you give us working PoC, thanks. I get error "Ha=
ck
Attempt: You don't allowed to reply this message!"
327 function wpu_reply_pm() {
328 global $current_user, $wpdb, $wpulang;
329 $msgid =3D $_GET["msgid"];
330 if(!$msgid || $msgid =3D=3D "") { echo "Error while messaging!"; re=
turn; }
331 $pm =3D $wpdb->get_row("SELECT * FROM $wpdb->prefix".private_messag=
es." WHERE id =3D $msgid", ARRAY_A);
332=20
333 if($pm['rcpid'] !=3D $current_user->ID) { echo "<p>".__('Hack Attem=
pt: You don\'t allowed to reply this message!', $wpulang)."</p>"; return; }
I tested with version 1.0.1
> # Dem0 :
> # http://renewedculture.com/wp-admin/profile.php?page=3Dwp-private-messag=
es/wpu_private_messages.php&wpu=3Dreply&msgid=3D[Sql]
> # http://www.rockfordravens.org/wp-admin/profile.php?page=3Dwp-private-me=
ssages/wpu_private_messages.php&wpu=3Dreply&msgid=3D[Sql]
Live sites as demo to SQL injection behind WordPress login, err what?
Also please note: This plugin hasn't been updated in over 2 years. It may no
longer be maintained or supported and may have compatibility issues when us=
ed
with more recent versions of WordPress.
---
Henri Salo
--mxv5cy4qt+RJ9ypb
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
iEYEARECAAYFAlHd9TQACgkQXf6hBi6kbk/y+gCePZdYjpqWxEQu7q58Nq8gcYAB
BVIAnjazLV7U67ThktccLwdjSabdWOyy
=LVIl
-----END PGP SIGNATURE-----
--mxv5cy4qt+RJ9ypb--