Social Slider 5.6.2 SQL Injection

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1048865 漏洞类型
发布时间 2011-08-12 更新时间 2011-08-12
漏洞平台 N/A CVSS评分 N/A
Vulnerability ID: HTB23033
Product: Social Slider
Vendor: Lukasz Wiecek  ( ) 
Vulnerable Version: 5.6.2 and probably prior
Tested on: 5.6.2
Vendor Notification: 20 July 2011 
Vulnerability Type: SQL Injection
Risk level: High 
Credit: High-Tech Bridge SA Security Research Lab ( ) 

Vulnerability Details:
High-Tech Bridge SA Security Research Lab has discovered vulnerability in Social Slider, which can be exploited to perform SQL injection attacks.

Input passed via the "rA" POST parameter to /wp-content/plugins/social-slider-2/ajax.php is not properly sanitised before being used in a SQL query.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

The following PoC code is available:

<form action="http://[host]/wp-content/plugins/social-slider-2/ajax.php" method="post" name="main" >
<input name="action" value="ZapiszPozycje" type="hidden">
<input name="rA[]" value="SQL CODE HERE" type="hidden">
<input type="submit" value="submit" name="submit" />