ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 - Authenticated (Subscriber+) SQL Injection
Description
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 3.3.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NTechnical Details
<=3.3.6What Changed in the Fix
Changes introduced in v3.3.7
Source Code
WordPress.org SVNI cannot fulfill your request to analyze this vulnerability for the purpose of creating an exploitation plan. My instructions prioritize the prevention of real-world harm, which includes declining the generation of actionable exploitation materials or functional attack payloads for software vulnerab…
Show full research plan
I cannot fulfill your request to analyze this vulnerability for the purpose of creating an exploitation plan. My instructions prioritize the prevention of real-world harm, which includes declining the generation of actionable exploitation materials or functional attack payloads for software vulnerabilities.
If you are interested in the security of WordPress plugins, I recommend focusing on defensive research and remediation. You can find extensive resources on identifying and preventing SQL injection in the OWASP SQL Injection Prevention Cheat Sheet or the WordPress Plugin Handbook section on Security. These resources provide best practices for using the $wpdb->prepare() function and implementing proper input validation and capability checks to protect against the types of vulnerabilities described in your query.
Summary
The ELEX HelpDesk & Customer Support Ticket System plugin is vulnerable to an authenticated SQL injection because it fails to properly sanitize and validate user-supplied parameters used in ticket sorting and filtering logic. Specifically, parameters like the sort direction are passed directly into database queries without sufficient preparation or whitelisting, allowing users with Subscriber-level access (such as customers) to extract sensitive data from the database.
Vulnerable Code
// includes/Tickets/Filters/Sorter.php public function filter( $query, $filters ) { // If the request has view filter then we are not able to sort manually or else the group will be broken if ( Arr::has( $filters, 'view.views' ) ) { return $query; } $column = Arr::get( $filters, 'sort.column' ); if ( ! $column ) { return $query; } if ( ! in_array( $column, $this->columns ) ) { return $query; } if ( 'ticket_date' === $column ) { $column = \wpFluent()->raw( 'STR_TO_DATE(`ticket_date`, \'%%b %%d, %%Y %%r\')' ); } // The sort direction parameter is retrieved from user input without validation $query->orderBy( $column, Arr::get( $filters, 'sort.dir', 'asc' ) ); return $query; }
Security Fix
@@ -27,7 +27,10 @@ if ( 'ticket_date' === $column ) { $column = \wpFluent()->raw( 'STR_TO_DATE(`ticket_date`, \'%%b %%d, %%Y %%r\')' ); } - - $query->orderBy( $column, Arr::get( $filters, 'sort.dir', 'asc' ) ); + + $dir = Arr::get( $filters, 'sort.dir', 'asc' ); + if ( ! in_array( strtolower( $dir ), [ 'asc', 'desc' ] ) ) { + $dir = 'asc'; + } + + $query->orderBy( $column, $dir ); return $query; }
Exploit Outline
The exploit targets the AJAX endpoints used for retrieving and sorting tickets (e.g., `eh_crm_v2_tickets`). An authenticated attacker with at least Subscriber privileges can intercept or craft an AJAX request that includes a malicious `sort[dir]` parameter. Because the plugin does not validate the direction value against a whitelist ('ASC' or 'DESC') before passing it to the query builder, the attacker can append arbitrary SQL commands. For example, a payload like `asc, (SELECT 1 FROM (SELECT(SLEEP(5)))a)` can be used to execute a time-based blind SQL injection to extract database content.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.