2 New Wordpress Plugin SQL Injection Vulnerabilities
That’s right Wordpresss kiddies, two new vulnerabilities, and they’re pretty nasty. Author Houssamix From H-T Team has released two remote SQL injection proof of concepts for WP-Cal and fGallery 2.4.1.
The vulnerability for WP-Cal exists in:
/wp-content/plugins/wp-cal/functions/editevent.php
and here’s what’s vulnerable:
$id = $_GET['id'];$event = $wpdb->get_row("SELECT * FROM $table WHERE id = $id");
Why? No sanitization of $id. Since id in the DB is a numerical value, only numbers should get passed in $id. I’m no PHP expert, but I’m sure this is an easy fix. If you’re not a PHP expert, either, I highly recommend you disable and remove this plugin immediately.
Next up, fGallery 2.4.1. The hole exists in:
/wp-content/plugins/fgallery/fim_rss.php
and here’s what’s vulnerable:
$cat = $wpdb->get_row("SELECT * FROM $cats WHERE id = $_GET[album]");$images = $wpdb->get_results("SELECT * FROM $imgsWHERE cat = $_GET[album] AND status = 'include'");
Again, there’s a lack of proper sanitization. Can you spot the hole?
I’d love to provide a fix, but since neither of these plugins are used on Nullamatix, I’ll leave the patching up to those bold enough to use this stuff. If you’re feeling generous and come across a fix, feel free to share in the comments. In the mean time, deactivate and remove these plugins until a patch or fix is released. Yet another potential for your non-vulnerable site hosted on a shared provider to get r00ted. Happy blogging!
Technology Made Simple
Here is the...
This is why you have to use as few plugins and check them all the time. I always find putting a blank index.html file in plugins can help too… Or closing it in cpanel or Apache (If you use it).
yea, good call. That reminded me, I hadn’t put a blank index.htm in my /plugins/ directory since the updrade. Thanks!
Well, I can tell you that the first one can be fixed by changing
$id = $_GET[’id’];
to
$id = (is_numeric($_GET[’id’])) ? intval($_GET[’id’]) : ”;
that checks to make sure that $_GET[’id’] is a number, and if it is it assigns the numerical value of it to $id.
Dunno about the second. Figured that one would help, at least!
Thanks for the heads up about the holes.