Wordpress salient Themes SQL Injection Vulnerability

2017.04.09
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: CWE-89

########################################################### # Exploit Title : Wordpress salient Themes SQL Injection Vulnerability # Exploit Author : Ashiyane Digital Security Team # Vendor Homepage: themenectar.com # Date : 2017 10 April # Category : Web App # Dork : inurl:"/wp-content/themes/salient/includes/portfolio-functions" # Software Link : http://bangalowshoemaking.com/fobi/wp-content/themes/salient/salient.zip ########################################################### ################### Vulnerability Details ####################### ########################################################### salient Themes SQL Injection Vulnerability Researched by Ashiyane Digital Security Team Location : localhost/Directory//wp-content/themes/salient/includes/portfolio-functions/video.php?post-id= Test parameter : post-id Injection type is Integer ########################################################### <?php // Access WordPress $absolute_path = __FILE__; $path_to_file = explode( 'wp-content', $absolute_path ); $path_to_wp = $path_to_file[0]; require_once( $path_to_wp . '/wp-load.php' ); $postid = stripslashes(htmlspecialchars_decode(filter_input(INPUT_GET, 'post-id', FILTER_SANITIZE_STRING))); $video_height = get_post_meta($postid, '_nectar_video_height', true); $video = get_post_meta($postid, '_nectar_video_embed', true); $video_m4v = get_post_meta($postid, '_nectar_video_m4v', true); $video_ogv = get_post_meta($postid, '_nectar_video_ogv', true); $video_poster = get_post_meta($postid, '_nectar_video_poster', true); if(empty($video_height)) $video_height = 480; wp_head(); wp_dequeue_script( 'my_acsearch' ); wp_dequeue_script( 'respond' ); ?> <script> jQuery(document).ready(function($){ if( $(window).width() <= 690 ){ function pp_video_height() { $('#pp-video-wrap').css('height',$('.mejs-container').width()/1.777); } $(window).resize(pp_video_height); pp_video_height(); } function videoshortcodeSize(){ $('.wp-video').each(function(){ var newWidth = $(this).width(); var $el = $(this).find('.wp-video-shortcode'); $(this).height($('.mejs-container').width()/1.777); }); } videoshortcodeSize(); $(window).resize(videoshortcodeSize); }); </script> <style> #header-outer { display: none!important;} html { overflow: hidden!important; } </style> </head> <div id="header-outer" data-header-resize="1"></div> <?php if ( floatval(get_bloginfo('version')) < "3.6" ) { ?> <style> body {background-color: #000; height: <?php echo $video_height + 33; ?>px!Important;} #wpadminbar { display: none;} html { margin-top: 0px!important; } .jp-video-container { margin-bottom: 0px!important;} .jp-jplayer { height: <?php echo $video_height; ?>px!important; } @media only screen and (min-width : 1px) and (max-width : 1050px) { body {background-color: transparent!important;} .jp-jplayer { height: auto!important; } } </style> <?php } else { ?> <style> body {background-color: #000; overflow-y:hidden; height: <?php echo $video_height; ?>px!Important;} #wpadminbar { display: none;} html { margin-top: 0px!important; } .mejs-mediaelement #me_flash_0_container { height: 100%; } .mejs-fullscreen-button { display: none!important; } .wp-video { width: 100%!important; } @media only screen and (min-width : 1px) and (max-width : 1050px) { body {background-color: transparent!important;} } </style> <?php } ?> <body class="pp-video-function"> <?php if ( floatval(get_bloginfo('version')) < "3.6" ) { nectar_video($postid); } else { //self hosted if(!empty($video_m4v) || !empty($video_ogv)) { $video_output = '[video '; if(!empty($video_m4v)) { $video_output .= 'mp4="'. $video_m4v .'" '; } if(!empty($video_ogv)) { $video_output .= 'ogv="'. $video_ogv .'"'; } $video_output .= ' poster="'.$video_poster.'"]'; echo '<div class="video">' . do_shortcode($video_output) . '</div>'; } //embed else { echo '<div id="pp-video-wrap">'.do_shortcode($video).'</div>'; } } wp_footer(); ?> ################################################ # Discovered By : Hassan Shakeri # Twitter : @ShakeriHassan - Fb.com/General.BlackHat - Me@Seravo.ir ###########################################################

References:

http://themenectar.com/
http://ashiyane.org/forums/
http://twitter.com/ShakeriHassan


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top