[wp-hackers] XSS, CSRF and blind SQL injection in GD Star Rating 1.9.22 (WordPress plugin)
harry at dxw.com
Fri Mar 28 12:37:19 UTC 2014
Software: GD Star Rating
CVSS: 8.5 (High; AV:N/AC:L/Au:S/C:C/I:N/A:C)
XSS, CSRF and blind SQL injection in GD Star Rating 1.9.22
This plugin is vulnerable to SQL injection. Carrying out an SQL
injection requires access to an administrator account. However, the form
contains no CSRF protection and is also vulnerable to XSS so an attacker
may not need direct access to an account to perform denial of service or
to compromise sensitive data.
Proof of concept
Proof of concept (see code/adm/db.php at line 154):
<input type="text" name="s" value="' and sleep(5) = '">
<input type="text" name="gdsr_search" value="Search Posts">
Disable the plugin until a fix is released.
dxw believes in responsible disclosure. Your attention is drawn to our
disclosure policy: https://security.dxw.com/disclosure/
Please contact us on security at dxw.com to acknowledge this report if you
received it via a third party (for example, plugins at wordpress.org) as
they generally cannot communicate with us on your behalf.
Please note that this vulnerability will be published if we do not
receive a response to this report with 14 days.
2014-02-18: Reported to plugins at wordpress.org
2014-03-28: No response received. Published.
Discovered by dxw:
Please visit security.dxw.com for more information.
More information about the wp-hackers