Wonderplugin Audio Player prior 2.0 admin/ wp-admin/admin-ajax.php itemid sql injection

Summaryinfo

A vulnerability has been found in Wonderplugin Audio Player and classified as critical. Impacted is an unknown function of the file wp-admin/admin-ajax.php of the component admin/. Performing a manipulation of the argument itemid results in sql injection. This vulnerability was named CVE-2015-2199. The attack may be initiated remotely. In addition, an exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, was found in Wonderplugin Audio Player. This affects an unknown part of the file wp-admin/admin-ajax.php of the component admin/. The manipulation of the argument itemid with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Multiple SQL injection vulnerabilities in the WonderPlugin Audio Player plugin before 2.1 for WordPress allow (1) remote authenticated users to execute arbitrary SQL commands via the item[id] parameter in a wonderplugin_audio_save_item action to wp-admin/admin-ajax.php or remote administrators to execute arbitrary SQL commands via the itemid parameter in the (2) wonderplugin_audio_show_item, (3) wonderplugin_audio_show_items, or (4) wonderplugin_audio_edit_item page to wp-admin/admin.php.

The weakness was presented 03/03/2015 (Website). It is possible to read the advisory at wonderplugin.com. This vulnerability is uniquely identified as CVE-2015-2199 since 03/03/2015. The exploitability is told to be easy. It is possible to initiate the attack remotely. A authentication is necessary for exploitation. Technical details and a public exploit are known. The attack technique deployed by this issue is T1505 according to MITRE ATT&CK.

A public exploit has been developed by Kacper Szurek and been published before and not just after the advisory. The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 15 days. During that time the estimated underground price was around $0-$5k. By approaching the search of inurl:wp-admin/admin-ajax.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 2.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (36086) and OSVDB (118508†). See VDB-74354 for similar entry. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Wonderplugin

Name

• Audio Player

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion