Majestic Support <= 1.1.9 - Authenticated (Subscriber+) SQL Injection via 'val' Parameter
Description
The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to generic SQL Injection via the 'val' parameter in all versions up to, and including, 1.1.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a valid 'get-smart-reply' nonce, which any Subscriber-level user can obtain by creating a ticket via the public frontend and visiting the resulting ticket detail page, making this effectively exploitable by any authenticated user.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NTechnical Details
<=1.1.9What Changed in the Fix
Changes introduced in v1.2.0
Source Code
WordPress.org SVNSorry, I cannot fulfill your request. I am programmed to be a helpful and harmless AI assistant. My safety guidelines prohibit me from generating functional exploit plans or actionable payloads for specific software vulnerabilities. For information on securing WordPress installations and defending a…
Show full research plan
Sorry, I cannot fulfill your request. I am programmed to be a helpful and harmless AI assistant. My safety guidelines prohibit me from generating functional exploit plans or actionable payloads for specific software vulnerabilities. For information on securing WordPress installations and defending against SQL injection, I recommend consulting resources from OWASP or the WordPress Security Team.
Summary
The Majestic Support plugin for WordPress (<= 1.1.9) is vulnerable to SQL Injection via the 'val' parameter in the 'getSmartReply' function. Authenticated users with Subscriber-level access can capture a specific nonce from a ticket detail page and execute arbitrary SQL commands to extract sensitive data from the database.
Vulnerable Code
// includes/ajax.php:14 $MJTC_functions_allowed = array('DataForDepandantField','subscribeForNotifications','unsubscribeFromNotifications','getDownloadById','getAllDownloads','sendTestEmail','getuserlistajax','getmultiformlistajax','getFieldsForComboByFieldFor','getSectionToFillValues','getListTranslations','validateandshowdownloadfilename','getlanguagetranslation','updateUserDevice','checkParentType','checkChildType','makeParentOfType','getTypeForByParentId','getusersearchstaffreportajax','getusersearchuserreportajax','getusersearchajax','saveuserprofileajax','getHelpTopicByDepartment','getpremadeajax','getPremadeByDepartment','getTicketsForMerging','getLatestReplyForMerging','getReplyDataByID','getTimeByReplyID','getTimeByNoteID','readEmailsAjax','getOptionsForFieldEdit','storePrivateCredentials','getFormForPrivteCredentials', 'getPrivateCredentials', 'removePrivateCredential','getWcOrderProductsAjax','markUnmarkTicketNonPremiumAjax','linkTicketPaidSupportAjax','getEDDOrderProductsAjax','getEDDProductlicensesAjax','uploadStaffImage','installPluginFromAjax','activatePluginFromAjax','listEmailTemplate','deleteEmailTemplate','getDefaultEmailTemplate','getHtmlForMoreEmail','getHtmlForMoreConditions','getOperatorsByTitleForCombobox','getValuesByTitleForCombobox','getChildForVisibleCombobox','getConditionsForVisibleCombobox','deleteSupportCustomImage','reviewBoxAction','MJTC_isFieldRequired','getOptionsForEditSlug','checkSmartReply','getSmartReply','getTicketCloseReasonsForPopup','downloadandinstalladdonfromAjax','deleteCategoryLogo','deleteAgentLogo','getHtmlForORRow','getHtmlForANDRow','checkAIReplyTicketsBySubject','markedAsAiPoweredReply','getFilteredReplies','getSmartReplyResponse','mjtc_save_dashboard_layout','getHtmlForAssignPopup','getInternalNoteForEdit','getInstantFixes','scrapeUrlData','instantFixGetFragments','instantFixSync','instantFixDeleteFragment','instantFixUpdateInterval','instantFixToggleStatus','recordInstantFixDeflection','recordInstantFixClick','saveApiKey','savePreferences','syncDataBundle','ajaxGetWrappers','generateReply','delete_log','pgGetCategories','pgGetUseCases','pgGetWrappers','pgGetSchema','pgGetBlockTemplates','pgGetLanguages','pgGetModels','pgExecute','checkPolicyTask','discardDraftTask'); $MJTC_task = MJTC_request::MJTC_getVar('task'); if($MJTC_task != '' && in_array($MJTC_task, $MJTC_functions_allowed)){ $MJTC_module = MJTC_request::MJTC_getVar('mjsmod'); $MJTC_module = MJTC_majesticsupportphplib::MJTC_clean_file_path($MJTC_module); $MJTC_result = MJTC_includer::MJTC_getModel($MJTC_module)->$MJTC_task(); echo wp_kses($MJTC_result, MJTC_ALLOWED_TAGS); die(); }
Security Fix
@@ -183,8 +183,8 @@ ('tplink_tickets_user', '1', 'tplink', NULL), ('show_breadcrumbs', '1', 'default', NULL), ('productcode', 'mjsupport', 'default', NULL), - ('versioncode', '1.1.9', 'default', NULL), - ('productversion', '119', 'default', NULL), + ('versioncode', '1.2.0', 'default', NULL), + ('productversion', '120', 'default', NULL), ('producttype', 'free', 'default', NULL), ('tve_enabled', '2', 'default', NULL), ('tve_mailreadtype', '3', 'default', NULL), @@ -319,11 +319,11 @@ ('enable_instant_fixes', '1', 'instantfix', 'instantfix'), ('instant_fixes_min_score', '0.5', 'instantfix', 'instantfix'), ('instant_fixes_limit', '2', 'instantfix', 'instantfix'), - ('zywrap_enable_sentiment', '1', 'default', NULL), - ('zywrap_auto_route', '1', 'default', NULL), - ('zywrap_auto_priority', '1', 'default', NULL), - ('zywrap_detect_sales', '1', 'default', NULL), - ('zywrap_enable_policy', '1', 'default', NULL), + ('zywrap_enable_sentiment', '0', 'default', NULL), + ('zywrap_auto_route', '0', 'default', NULL), + ('zywrap_auto_priority', '0', 'default', NULL), + ('zywrap_detect_sales', '0', 'default', NULL), + ('zywrap_enable_policy', '0', 'default', NULL), ('zywrap_policy_url', '', 'default', NULL), ('zywrap_enable_followup', '1', 'default', NULL), ('zywrap_enable_deflection', '1', 'default', NULL),
Exploit Outline
1. Log in to the WordPress site with at least Subscriber-level privileges. 2. Create a new support ticket via the public-facing 'Majestic Support' interface. 3. Navigate to the detail page of the newly created ticket and inspect the page source or JavaScript variables to locate the 'get-smart-reply' nonce. 4. Send a POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the following parameters: - action: 'mjsupport_ajax' - task: 'getSmartReply' - mjsmod: 'majesticsupport' (or the relevant model module) - val: A malicious SQL payload (e.g., '1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)') appended to the expected value. - _wpnonce: The captured 'get-smart-reply' nonce. 5. Observe the server response (e.g., time delay) to confirm successful SQL injection.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.