Taskbuilder <= 5.0.8 - Authenticated (Subscriber+) SQL Injection via 'task_search' Parameter
Description
The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to generic SQL Injection via the 'task_search' parameter in all versions up to, and including, 5.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The wppm_get_task_list AJAX handler performs no capability check and no nonce verification, meaning any authenticated user including those with Subscriber-level access can invoke it directly.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NTechnical Details
What Changed in the Fix
Changes introduced in v5.0.9
Source Code
WordPress.org SVNI cannot fulfill this request. I am prohibited from generating actionable exploitation plans, research guides, or payloads for specific security vulnerabilities on concrete targets, including WordPress plugins. For information on how to identify and prevent vulnerabilities like SQL injection, you ma…
Show full research plan
I cannot fulfill this request. I am prohibited from generating actionable exploitation plans, research guides, or payloads for specific security vulnerabilities on concrete targets, including WordPress plugins. For information on how to identify and prevent vulnerabilities like SQL injection, you may consult resources such as the WordPress Plugin Handbook's Security Section or the OWASP SQL Injection Prevention Cheat Sheet.
Summary
The Taskbuilder plugin for WordPress is vulnerable to SQL Injection via the 'task_search' parameter in the 'wppm_get_task_list' AJAX action. Due to insufficient escaping of user-supplied input and the lack of prepared statements, authenticated attackers (Subscriber and above) can inject arbitrary SQL commands to extract sensitive data from the database.
Vulnerable Code
// includes/admin/projects/open_project/wppm_view_project_tasks.php:19 $search_tag = isset($_POST['task_search']) ? sanitize_text_field(wp_unslash($_POST['task_search'])) : ''; --- // includes/admin/projects/open_project/wppm_view_project_tasks.php:188-200 $search_tag_text = '%'.$wpdb->esc_like($search_tag).'%'; if($current_user->has_cap('manage_options') || $wppm_current_user_capability == 'wppm_admin'){ $query = ("SELECT Task.*,proj.project_name,task_statuses.status_name,task_statuses.color,task_priorities.priority_name,task_priorities.color as priority_color,proj_meta.project_id FROM {$wpdb->prefix}wppm_task Task Left join {$wpdb->prefix}wppm_project proj ON Task.project = proj.id Left join {$wpdb->prefix}wppm_task_statuses task_statuses ON Task.status = task_statuses.id Left join {$wpdb->prefix}wppm_task_priorities task_priorities ON Task.priority = task_priorities.id Left join {$wpdb->base_prefix}users user ON (FIND_IN_SET(user.id,Task.users)>0) AND user.display_name LIKE '$search_tag_text' Left join {$wpdb->prefix}wppm_project_meta proj_meta ON Task.project = proj_meta.project_id ");
Security Fix
@@ -193,7 +193,7 @@ Left join {$wpdb->prefix}wppm_project proj ON Task.project = proj.id Left join {$wpdb->prefix}wppm_task_statuses task_statuses ON Task.status = task_statuses.id Left join {$wpdb->prefix}wppm_task_priorities task_priorities ON Task.priority = task_priorities.id - Left join {$wpdb->base_prefix}users user ON (FIND_IN_SET(user.id,Task.users)>0) AND user.display_name LIKE '$search_tag_text' + Left join {$wpdb->base_prefix}users user ON (FIND_IN_SET(user.ID,Task.users)>0) Left join {$wpdb->prefix}wppm_project_meta proj_meta ON Task.project = proj_meta.project_id "); $no_of_rows = ( "SELECT count(*) FROM ($query"); @@ -249,7 +249,7 @@ Left join {$wpdb->prefix}wppm_task_statuses task_statuses ON Task.status = task_statuses.id Left join {$wpdb->prefix}wppm_task_priorities task_priorities ON Task.priority = task_priorities.id Left join {$wpdb->prefix}wppm_project_users proj_users ON Task.project = proj_users.proj_id - Left join {$wpdb->base_prefix}users user ON (FIND_IN_SET(user.id,Task.users)>0) AND user.display_name LIKE '$search_tag_text' + Left join {$wpdb->base_prefix}users user ON (FIND_IN_SET(user.ID,Task.users)>0) Left join {$wpdb->prefix}wppm_project_meta proj_meta ON Task.project = proj_meta.project_id ");
Exploit Outline
The vulnerability is reachable via the AJAX action 'wppm_get_task_list'. An authenticated attacker with Subscriber-level permissions or higher can trigger the vulnerability by sending a POST request to /wp-admin/admin-ajax.php. The payload should include the 'action' parameter set to 'wppm_get_task_list' and a 'task_search' parameter containing a SQL injection string. Because the 'task_search' input is only processed with 'esc_like' and then directly concatenated into the SQL query inside single quotes, an attacker can break out of the string literal using a single quote (e.g., "' OR (SELECT 1 FROM (SELECT(SLEEP(5)))a)-- -") to execute time-based or union-based SQL injection.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.