CP Contact Form with Paypal <= 1.3.61 - Authenticated (Contributor+) SQL Injection

This exploitation research plan targets an authenticated SQL injection vulnerability in the CP Contact Form with PayPal plugin (versions <= 1.3.61). The vulnerability arises from the plugin's data management logic, which processes user-supplied parameters in raw SQL queries without using $wpdb->prepare().

1. Vulnerability Summary

• Vulnerability: Authenticated SQL Injection
• Affected Parameter: ids (or uids) used in CSV export or message management.
• Vulnerable Sink: cp_contactformpp_data_management_loaded() in cp_contactformpp_functions.php.
• Reason: The plugin uses string concatenation to build a SELECT query with an IN clause using the user-supplied ids parameter. It fails to sanitize the input or use prepared statements, allowing an attacker to break out of the query.
• Privilege Level: Contributor or higher. While the settings page is limited to manage_options, the data processing logic in wp_loaded often checks for the edit_posts capability, which Contributors possess.

2. Attack Vector Analysis

• Endpoint: /wp-admin/index.php or / (triggered via the wp_loaded hook).
• Action: cp_contact_form_paypal_export_csv.
• HTTP Parameter: ids (sent via GET or POST).
• Authentication: Required (Contributor-level session).
• Preconditions: At least one entry must exist in the cp_contact_form_paypal_posts table for the query to return results or for the time-based injection to be clearly observable.

3. Code Flow

1. Entry Point: The plugin registers cp_contactformpp_data_management_loaded on the wp_loaded hook in cp_contactformpp.php.

   add_action('wp_loaded', 'cp_contactformpp_data_management_loaded' );
   

2. Logic Dispatch: Inside cp_contactformpp_functions.php, the function cp_contactformpp_data_management_loaded() checks for the action parameter.

   function cp_contactformpp_data_management_loaded() {
       if (isset($_GET['action']) && $_GET['action'] == 'cp_contact_form_paypal_export_csv') {
           // Capability check (often edit_posts or missing)
           if (current_user_can('edit_posts')) {
               cp_contact_form_paypal_export_csv();
           }
       }
   }
   

3. The Sink: The export function retrieves the ids parameter and concatenates it into a SQL query.

   function cp_contact_form_paypal_export_csv() {
       global $wpdb;
       $ids = $_GET['ids']; // SINK: Directly from $_GET
       $table = $wpdb->prefix . "cp_contact_form_paypal_posts";
       // Vulnerable Query
       $results = $wpdb->get_results("SELECT * FROM $table WHERE id IN ($ids)");
       // ... processes $results into CSV ...
   }
   

4. Nonce Acquisition Strategy

In many versions of this plugin, the wp_loaded actions for CSV export