Uber · Report #117080
Multiple Vulnerabilities (Including SQLi) in love.uber.com
Summary
There seems to be some confusion here which is being worked out. We feel the summary provided by siddiki is inaccurate, please see the comment thread for more information.
Long story short. This report #117080 was created @ 18th February 2016 - not eligible for a bounty. A duplicate #125181 was reported by @iad @ 22nd March 2016 - Rewarded
About the comment, "Since this is directly related to your report #117068 we are going to handle payout for the issue on that ticket" They never did. Monetary reward of $3000 paid for the XSS only! ($3000 is the standard payout for XSS in UBER because of their unclear bug bounty rules)
How it was found
Hi, I noticed you are using a critically vulnerable version of WMPL.
By accessing http://love.uber.com/wp-content/plugins/sitepress-multilingual-cms/changelog.md, Attacker could find out http://love.uber.com/ is running WMPL version 3.1.8.4
Which is Vulnerable to,
- SQL injection which gives full access to the WordPress database.
- Page, post and menu deletion by an unauthenticated attacker
- Unauthenticated administrative functions which may lead to RCE (remote code execution)
- Cross Site Scripting (XSS)
SOURCES:
- https://klikki.fi/adv/wpml.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2791
- https://www.exploit-db.com/exploits/36414/
- http://darkmatters.norsecorp.com/2015/03/16/four-wordpress-wpml-plugin-vulnerabilities-impact-400000-websites/
FIX:
According to Official WPML Security update, System administrators should update to at-least version 3.1.9 which was released on march 11th, 2015 to resolve these issues.
looking forward!