bugtraq - Sql injection in AJAX post Search wordpress plugin

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201211061848.qA6ImwfE029378@sf01web3.securityfocus.com>
Date: Tue, 6 Nov 2012 18:48:58 GMT
From: marcelavbx@...il.com
To: bugtraq@...urityfocus.com
Subject: Sql injection in AJAX post Search wordpress plugin

#############################
Exploit Title : SQl INJECTION AJAX Post Search --- wordpress plugin---
Author:Marcela Benetrix
home:www.girlinthemiddle.net
Date: 10/12/12
version: 1.1
software link: http://wordpress.org/extend/plugins/cardoza-ajax-search/
#############################
AJAX Post Search wordpress plugin description
This plugin will allow your website visitors to search the posts of your site without page refresh.
##########################
SQL (blind) injection description
The problem was located in :cardoza_ajax_search.php file, to be more specific  the_search_function() . I could see that the srch_txt field hadn't been sanitized.

POC:

/wp-admin/admin-ajax.php/?srch_txt='or 1=1-- &action=the_search_text

via ajax

it is possible to access the database and as a consequence  get user information such as usernames, passwords among other data

##########################
Vendor Notification
10/12/2012 to: the developer. He replied immediately and fixed the problem.
posted in plugin track repository http://plugins.trac.wordpress.org/ticket/1588 
Because of it, a new version has been released