WordPress Mingle Forum 1.0.32.1 Cross Site Scripting / SQL Injection

2012-01-22 / 2012-10-09
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89
CWE-79


CVSS Base Score: 6.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

# Exploit Title: Wordpress Mingle Forum plugin <= 1.0.32.1 Multiple Vulnerabilities # Date: 2012/01/18 # Author: Gianluca Brindisi (gATbrindi.si @gbrindisi http://brindi.si/g/) # Software Link: http://downloads.wordpress.org/plugin/mingle-forum.1.0.32.1.zip # Version: 1.0.32.1 You need an authenticated session to exploit the following vulnerabilities. 2) SQL Injection: POST: admin.php?page=mfgroups&mingleforum_Action=usergroups delete_usergroups: Delete dele_usrgrp%5B%5D: 1 [SQLI] Vulnerable code: function delete_usergroups(){ if (isset($_POST['delete_usergroups'])){ global $wpdb, $table_prefix; $delete_usrgrp = $_POST['delete_usrgrp']; $groups = ""; $count = count($delete_usrgrp); for($i = 0; $i < $count; $i++){ $wpdb->query("DELETE FROM ".$table_prefix."forum_usergroups WHERE id = {$delete_usrgrp[$i]}"); $wpdb->query("DELETE FROM ".$table_prefix."forum_usergroup2user WHERE `group` = {$delete_usrgrp[$i]}"); } return true; } return false; 2) SQL Injection: POST: admin.php?page=mfgroups&mingleforum_action=usergroups&do=add_user_togroup togroupusers: users usergroup: bar [SQLI] add_user_togroup: Add+users Vulnerable code: $group = $_POST['usergroup']; --- $msg = __("User", "mingleforum")." \"$user\" ".__("added successfully", "mingleforum")."<br />"; $sql = "INSERT INTO ".$table_prefix."forum_usergroup2user (user_id, `group`) VALUES('$id', '$group')"; $wpdb->query($sql); ++$added; 2) Stored XSS: admin.php?page=mingle-forum Some options are not escaped so you can inject a payload in the admin interface. Notice that every option is passed trough update_option() before being saved in the db so no sqli here Vulnerable code: 'forum_posts_per_page' => $wpdb->escape($_POST['forum_posts_per_page']), 'forum_threads_per_page' => $wpdb->escape($_POST['forum_threads_per_page']), 'forum_require_registration' => $_POST['forum_require_registration'], 'forum_show_login_form' => $_POST['forum_show_login_form'], 'forum_date_format' => $wpdb->escape($_POST['forum_date_format']), 'forum_use_gravatar' => $_POST['forum_use_gravatar'], 'forum_show_bio' => $_POST['forum_show_bio'], 'forum_skin' => $op['forum_skin'], 'forum_use_rss' => $_POST['forum_use_rss'], 'forum_use_seo_friendly_urls' => $_POST['forum_use_seo_friendly_urls'], 'forum_allow_image_uploads' => $_POST['forum_allow_image_uploads'], 'notify_admin_on_new_posts' => $_POST['notify_admin_on_new_posts'], 'set_sort' => $op['set_sort'], 'forum_use_spam' => $_POST['forum_use_spam'], 'forum_use_bbcode' => $_POST['forum_use_bbcode'], 'forum_captcha' => $_POST['forum_captcha'], 'hot_topic' => $_POST['hot_topic'], 'veryhot_topic' => $_POST['veryhot_topic'], 'forum_display_name' => $_POST['forum_display_name'], 'level_one' => $_POST['level_one'], 'level_two' => $_POST['level_two'], 'level_three' => $_POST['level_three'], 'level_newb_name' => $_POST['level_newb_name'], 'level_one_name' => $_POST['level_one_name'], 'level_two_name' => $_POST['level_two_name'], 'level_three_name' => $_POST['level_three_name'], 'forum_db_version' => $op['forum_db_version'], 'forum_disabled_cats' => explode(",",$_POST['forum_disabled_cats']) 3) Stored XSS and SQLI: admin.php?page=mfstructure Adding a new forum both name and description fields are not sanitized so stored xss payload in admin interface AND forum pages is possible. They are escaped only for sqli except for add_forum_group_id which is exploitable Vulnerable code: $add_forum_description = $wpdb->escape($_POST['add_forum_description']); $add_forum_name = $wpdb->escape($_POST['add_forum_name']); $add_forum_group_id = $_POST['add_forum_group_id']; --- $wpdb->query("INSERT INTO ".$table_prefix."forum_forums (name, description, parent_id, sort) VALUES('$add_forum_name', '$add_forum_description', '$add_forum_group_id', '$max')"); 4) Stored XSS: admin.php?page=mfads Every textarea input is not sanitized and can lead to stored xss payloads in admin interface and forums pages (this is somehow intended behavior since HTML is allowed but still...) i.e: "></textarea>[XSS] Vulnerable code: 'mf_ad_above_forum_on' => $_POST['mf_ad_above_forum_on'], 'mf_ad_above_forum' => $_POST['mf_ad_above_forum_text'], 'mf_ad_below_forum_on' => $_POST['mf_ad_below_forum_on'], 'mf_ad_below_forum' => $_POST['mf_ad_below_forum_text'], 'mf_ad_above_branding_on' => $_POST['mf_ad_above_branding_on'], 'mf_ad_above_branding' => $_POST['mf_ad_above_branding_text'], 'mf_ad_above_info_center_on' => $_POST['mf_ad_above_info_center_on'], 'mf_ad_above_info_center' => $_POST['mf_ad_above_info_center_text'], 'mf_ad_above_quick_reply_on' => $_POST['mf_ad_above_quick_reply_on'], 'mf_ad_above_quick_reply' => $_POST['mf_ad_above_quick_reply_text'], 'mf_ad_above_breadcrumbs_on' => $_POST['mf_ad_above_breadcrumbs_on'], 'mf_ad_above_breadcrumbs' => $_POST['mf_ad_above_breadcrumbs_text'], 'mf_ad_below_first_post_on' => $_POST['mf_ad_below_first_post_on'], 'mf_ad_below_first_post' => $_POST['mf_ad_below_first_post_text'], 'mf_ad_custom_css' => $_POST['mf_ad_custom_css']

References:

http://downloads.wordpress.org/plugin/mingle-forum.1.0.32.1.zip
http://brindi.si/g/


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top