OttoKit <= 1.1.20 - Authenticated (Administrator+) SQL Injection

Vulnerability Summary

The OttoKit (suretriggers) plugin for WordPress is vulnerable to an authenticated SQL injection in version 1.1.20 and below. The vulnerability exists in the administrative "Outgoing Requests" view, where the orderby and order parameters are used in a database query without sufficient escaping or proper preparation (specifically using %s placeholders in wpdb->prepare() for SQL identifiers like column names, or direct concatenation). Since wpdb->prepare()'s %s placeholder quotes values as strings, it is unsuitable for ORDER BY clauses, often leading developers to bypass it with unsafe concatenation.

Attack Vector Analysis

• Endpoint: wp-admin/admin.php
• Query Parameters:
  • page=suretriggers-status
  • tab=st_outgoing_requests
• Vulnerable Parameters: orderby, order
• Authentication: Administrator+ (High privileges required).
• Injection Type: Time-based Blind SQL Injection or Error-based SQL Injection.
• Preconditions: The plugin must be active. The attacker must be logged in as an administrator.

Code Flow

1. Entry Point: An administrator navigates to the plugin's status page: admin.php?page=suretriggers-status&tab=st_outgoing_requests.
2. File Loading: WordPress loads src/Admin/Views/st-admin-outgoing-req-page.php.
3. Class Initialization: The script instantiates SureTriggersWebhookRequestsTable, which extends WP_List_Table.
4. Data Preparation: The prepare_items() method is invoked (line 166).
5. Input Capture: The code retrieves unsanitized (only sanitize_text_field filtered) input from $_REQUEST['orderby'] and $_REQUEST['order'] (lines 182-184).
6. SQL Sink: The input is used in $wpdb->get_results() via a flawed $wpdb->prepare() call (line 189).

   // src/Admin/Views/st-admin-outgoing-req-page.php
   $orderby = isset( $_REQUEST['orderby'] ) ? sanitize_text_field( $_REQUEST['orderby'] ) : 'id';
   $order   = isset( $_REQUEST['order'] ) ? sanitize_text_field( $_REQUEST['order'] ) : 'ASC';
   // ...
   $this->items = $wpdb->get_results( $wpdb->prepare( "SELECT ... FROM $this->table_name $where ORDER BY %s %s LIMIT %d OFFSET %d", $orderby, $order, $per_page, $offset ), ARRAY_A );
   

   If %s is used, the query becomes ORDER BY 'column' 'ASC', which is invalid SQL. If the vulnerable version instead used concatenation (e.g., ORDER BY $orderby $order), the injection is direct.

Nonce Acquisition Strategy

While the orderby and order parameters are typically handled via GET requests for sorting in WP_List_Table and may not require a nonce for simple viewing, the page includes a nonce for bulk actions.

1. Navigate to the page: Use browser_navigate to wp-admin/admin.php?page=suretriggers-status&tab=st_outgoing_requests.
2. Extract Nonce: The nonce is stored in a hidden input field with the name _wpnonce.
3. Action String: The nonce is created using wp_create_nonce( 'suretriggers_requests_nonce_action' ).
4. Variable extraction: Use browser_eval to get the value: document.querySelector('input[name="_wpnonce"]').value.

Exploitation Strategy

We will use a time-based blind SQL injection payload via the orderby parameter.

1. Confirm Vulnerability (Time-based)

• Request Method: GET
• URL: http://localhost:8080/wp-admin/admin.php
• Parameters:
  • page: suretriggers-status
  • tab: `