SQL Injection in ClearSale Total WordPress Plugin

Executive Summary

The ClearSale Total plugin for WordPress has a SQL Injection vulnerability in the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJAX action. This vulnerability affects all versions up to and including 3.4.2.

The AJAX handler is accessible to unauthenticated users and includes a nonce verification check that is ineffective because the failure branch's termination code is commented out, allowing execution to continue regardless of nonce validity.

On PHP versions below 8.0, an attacker can exploit loose type juggling by submitting a specially crafted string (e.g., "4 AND SLEEP(5)") that bypasses a switch-case guard and reaches an unquoted SQL UPDATE query. This allows the attacker to append additional SQL commands to extract sensitive data from the database.

Exploitation requires the target server to be running PHP versions less than 8.0.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to perform SQL Injection attacks on the WordPress site using the ClearSale Total plugin.

Attackers can extract sensitive information from the database by injecting additional SQL queries, potentially compromising confidential data.

Because the vulnerability does not require authentication and can be triggered remotely, it poses a significant security risk.

The CVSS base score of 7.5 indicates a high severity impact, specifically affecting confidentiality without impacting integrity or availability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to perform SQL Injection attacks that can extract sensitive information from the database.

Exposure of sensitive data due to such an attack could lead to non-compliance with data protection regulations such as GDPR and HIPAA, which require the protection of personal and sensitive information.

Therefore, exploitation of this vulnerability may result in violations of these standards by compromising confidentiality of protected data.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for suspicious POST requests to the AJAX action `clearsale_total_push` that include the `pagseguro[metodo]` parameter with unusual values, such as SQL injection payloads like "4 AND SLEEP(5)".

Network detection can involve capturing and analyzing HTTP POST traffic to identify attempts to exploit the SQL injection via the `pagseguro[metodo]` parameter.

On the server, you can check web server logs for POST requests to `admin-ajax.php` with the `action=clearsale_total_push` parameter and inspect the `pagseguro[metodo]` values for suspicious input.

Example commands to detect exploitation attempts include:

• Using grep on web server logs: `grep 'action=clearsale_total_push' /var/log/apache2/access.log | grep 'pagseguro%5Bmetodo%5D='`
• Using curl to test the vulnerability (only in a safe testing environment): `curl -X POST -d 'action=clearsale_total_push&pagseguro[metodo]=4 AND SLEEP(5)' https://targetsite.com/wp-admin/admin-ajax.php` and observe response delays.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the ClearSale Total plugin to a version later than 3.4.2 where this vulnerability is fixed.

If an update is not immediately possible, restrict access to the vulnerable AJAX action by limiting unauthenticated access to `clearsale_total_push`.

Additionally, ensure your server is running PHP version 8.0 or higher, as the vulnerability relies on PHP versions below 8.0.

Implement Web Application Firewall (WAF) rules to block suspicious SQL injection payloads targeting the `pagseguro[metodo]` parameter.

Useful 0 Not Useful 0