On Sat, Jun 29, 2013 at 03:02:37PM +0000, iedb.team@xxxxxxxxx wrote: > # Exploit Title : Wordpress wp-private-messages Plugin Sql Injection vulnerability > # Software Link : http://wordpress.org/plugins/wp-private-messages/ > > # http://www.Site.com/wp-admin/profile.php?page=wp-private-messages/wpu_private_messages.php&wpu=reply&msgid=[Sql] Could not reproduce. Could you give us working PoC, thanks. I get error "Hack Attempt: You don't allowed to reply this message!" 327 function wpu_reply_pm() { 328 global $current_user, $wpdb, $wpulang; 329 $msgid = $_GET["msgid"]; 330 if(!$msgid || $msgid == "") { echo "Error while messaging!"; return; } 331 $pm = $wpdb->get_row("SELECT * FROM $wpdb->prefix".private_messages." WHERE id = $msgid", ARRAY_A); 332 333 if($pm['rcpid'] != $current_user->ID) { echo "<p>".__('Hack Attempt: You don\'t allowed to reply this message!', $wpulang)."</p>"; return; } I tested with version 1.0.1 > # Dem0 : > # http://renewedculture.com/wp-admin/profile.php?page=wp-private-messages/wpu_private_messages.php&wpu=reply&msgid=[Sql] > # http://www.rockfordravens.org/wp-admin/profile.php?page=wp-private-messages/wpu_private_messages.php&wpu=reply&msgid=[Sql] Live sites as demo to SQL injection behind WordPress login, err what? Also please note: This plugin hasn't been updated in over 2 years. It may no longer be maintained or supported and may have compatibility issues when used with more recent versions of WordPress. --- Henri Salo
Attachment:
signature.asc
Description: Digital signature
