tuannq2299/cve-2021-43408Technical analysis and proof-of-concept exploit for CVE-2021-43408, a SQL injection vulnerability in the WordPress Duplicate Post plugin version 1.1.9, with step-by-step exploitation guide and remediation advice.
WordPress is an open-source CMS (Content Management System) software, a content management system. Instead of using HTML encoding language, WP is written in the PHP programming language using MySQL database platform. WordPress was founded by programmers Matt Mullenweg and Mike Little. Currently, WordPress is owned by the company Automattic, headquartered in San Francisco, California, United States.
The WordPress plugin Duplicate Post in versions 1.1.9 and below suffers from a SQL Injection vulnerability. This type of exploitation allows an attacker to inject SQL queries, thereby being able to read, modify, or even delete resources in the database.
This vulnerability can be exploited by any authenticated user who has permission to use the Duplicate Post plugin functionality. By default, only Admin has this permission, however, permissions can be modified so that Editor, Author, Contributor, and even Subscriber can also use this plugin.
CVE-2021-43408 was discovered on "11/19/2021" and is rated as HIGH severity according to the CVSS score.
The root cause of this vulnerability is that data sent from the user request is not sanitized before being used in SQL execution.
More specifically, in the file post/handler.php, in the function cdn_insert_post()
function cdp_insert_post($id, $data, $times, $areWePro, $isChild = false, $p_ids = null, $site) {
// Get Wordpress database
global $wpdb;
// Create empty array for new id(s) and error(s)
$results = array('ids' => array(), 'error' => 0, 'counter' => 0);
// Get Counter value
$prefix = (($site != -1) ? $wpdb->get_blog_prefix($site) : $wpdb->get_blog_prefix());
$newestId = $wpdb->get_results("SELECT post_id FROM {$prefix}postmeta WHERE meta_key = '_cdp_origin' AND meta_value = {$id} ORDER BY post_id DESC LIMIT 1", ARRAY_A);
$idis controlled by the attacker
The variable $id is passed into the function containing the SQL query without any sanitization. This function is called via the WordPress Ajax wp_ajax_cdp_action_handling.
It can be seen that the parameter id is passed through the function cdn_sanitize_array, where the post data fields are processed through the function sanitize_text_field, which escapes any single quote ' in the data string.
The data fields are processed with
sanitize_text_field
However, the code has a flaw when passing the data of the Integer field into the SQL execution statement (the id field). An attacker can exploit this and inject additional SQL statements into the value of this field. Therefore, to control the SQL query, the attacker only needs to avoid using the ' character.
Step 1: Log in as Admin user, proceed to install the Duplicate Post plugin version 1.1.9. This plugin helps users duplicate existing posts.
Step 2: Navigate to the Posts section, select a post, choose the Copy action, and click Apply.
Step 3: Select Setting: Default and click Copy.
Step 4: Intercept the HTTP request. The field to note here is id; you can see the data in this field is an Integer.
Step 5: Inject the SQL Injection payload, send the request, and observe that it takes 9 seconds for the server to respond → SQL Injection successful.
Payload: 1 and (select*from(select(sleep(9)))a)--
