WordPress Plugin KBoard 2.7 - SQL Injection

2016.10.01

Credit: Persian Hack Team

Risk: Medium

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-89

Dork: intitle:"KBoard 2.7"

######################
# Exploit Title : WordPress Plugin KBoard 2.7 - SQL Injection 
# Exploit Author :  Persian Hack Team
# Homepage : http://persian-team.ir
# Google Dork : intitle:"KBoard 2.7"
# Vendor Homepage : http://www.cosmosfarm.com/products/kboard
# Category [ Webapps ]
# Tested on [ Win ]
# Version : 2.7
# Date 2016/09/26
######################
#
# PoC
#    => Sql Injection :
# uid Parameter Vulnerable To SQL
# Demo :
# http://www.site.com/wp-content/plugins/kboard/board.php?pageid=1&board_id=1&mod=document&uid=[Inject Here]
# Video : http://persian-team.ir/showthread.php?tid=162
######################
# Discovered by :  FireKernel & T3NZOG4N & Mojtaba MobhaM 
# B3li3v3 M3 I will n3v3r St0p
# Greetz : Dr.Askarzade & Masood Ostad & Dr.Koorangi &  Milad Hacking & JOK3R $ Mr_Mask_Black And All Persian Hack Team Members
######################

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

WordPress Plugin KBoard 2.7 - SQL Injection

Dork: intitle:"KBoard 2.7"

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.