Wordpress SQL Inject Vuln Plugin (1 Viewer)

[Morningstar]

Wordpressin pluginlerinden biri olan newsletter-master SQL inject açığı barındırdığı tespit edildi.

Dork:
inurllugins/wordpress-newsletter-master

Vulnerable page:
/wp-content/plugins/wordpress-newsletter-master/newsletter.php


Zaafiyetin kaynaklandığı kod parçası;

Line241: $wpnewsletter_ip = $_GET['kei']; Line243: $wpnewsletter_ip = checkvalid($wpnewsletter_ip); Line247: $sql = "SELECT * FROM `" . $dbprefix . "newsletter_users` WHERE MD5(CONCAT(`email`, `name`)) = '" . $wpnewsletter_ip . "'"; Line249: mysql_query $result = mysql_query($sql);

POC : http://site.com/wp-content/plugins/wordpress-newsletter-master/newsletter.php?wpnewsletter_ip=[SQL Injection]

 

[SHuTTeRLooK]

Eline emeğine sağlık dostum

 

[Steve.XSS]

Thank you bro

 

[Witcher]

Thank you bro

hello babe

 

[crash-d4rk]

eline sağlık

 

[temy]

Wordpressin pluginlerinden biri olan newsletter-master SQL inject açığı barındırdığı tespit edildi.

Dork:
inurllugins/wordpress-newsletter-master

Vulnerable page:
/wp-content/plugins/wordpress-newsletter-master/newsletter.php


Zaafiyetin kaynaklandığı kod parçası;

Line241: $wpnewsletter_ip = $_GET['kei']; Line243: $wpnewsletter_ip = checkvalid($wpnewsletter_ip); Line247: $sql = "SELECT * FROM `" . $dbprefix . "newsletter_users` WHERE MD5(CONCAT(`email`, `name`)) = '" . $wpnewsletter_ip . "'"; Line249: mysql_query $result = mysql_query($sql);

POC : http://site.com/wp-content/plugins/wordpress-newsletter-master/newsletter.php?wpnewsletter_ip=[SQL Injection]

 

[GnG]

Wordpressin pluginlerinden biri olan newsletter-master SQL inject açığı barındırdığı tespit edildi.

Dork:
inurllugins/wordpress-newsletter-master

Vulnerable page:
/wp-content/plugins/wordpress-newsletter-master/newsletter.php


Zaafiyetin kaynaklandığı kod parçası;

Line241: $wpnewsletter_ip = $_GET['kei']; Line243: $wpnewsletter_ip = checkvalid($wpnewsletter_ip); Line247: $sql = "SELECT * FROM `" . $dbprefix . "newsletter_users` WHERE MD5(CONCAT(`email`, `name`)) = '" . $wpnewsletter_ip . "'"; Line249: mysql_query $result = mysql_query($sql);

POC : http://site.com/wp-content/plugins/wordpress-newsletter-master/newsletter.php?wpnewsletter_ip=[SQL Injection]

Eline saglik cano