# Multiple vulnerabilities in a WordPress plugin at drive.uber.com

Unauthenticated SQL injection in abandoned q-and-a WordPress plugin on drive.uber.com, triggered via CSRF against a logged-in admin, allowing time-based DB extraction.

- Payout: hidden
- Severity: high
- Program: Uber
- Found by: 0xsyndr0me
- Disclosed: 2016-08-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/135288
- Library page: https://bugbountylibrary.com/r/h1%3A135288
- Tags: area:web domain:web impact:data-leak kind:bounty platform:hackerone sev:high tech:php tech:wordpress technique:blind technique:source-review vuln:csrf vuln:sqli

**Target:** WordPress plugin q-and-a reorder endpoint (wp-admin/edit.php?post_type=qa_faqs&page=faqpageorder)
**Root cause:** POST parameters hdnParentID and pages are concatenated directly into SQL queries in plugins/q-and-a/inc/reorder.php without escaping or parameterization.
**Steps:**
1. Identify drive.uber.com/ukmarketplace runs WordPress 4.4.2 with the removed q-and-a plugin v1.0.6.2.
2. Download plugin source from plugins.svn.wordpress.org/q-and-a/trunk/ and review reorder.php.
3. Craft an auto-submitting HTML form POSTing to `/wp-admin/edit.php?post_type=qa_faqs&page=faqpageorder` with `hdnParentID=IF(MID(VERSION(),1,1) = 5, SLEEP(5), 0)` and `btnReturnParent=1`.
4. Alternatively POST `pages=IF(MID(VERSION(),1,1) = 5, SLEEP(5), 0)` with `btnSubPages=1`.
5. Lure a logged-in admin to the page; observe 5-second delay confirming SQLi.
**How found:** Noticed outdated WordPress 4.4.2, enumerated plugins, found q-and-a was removed from the WP repository, downloaded its source from SVN, and audited reorder.php for unescaped POST parameters.
**Exploitation:** Attacker hosts a malicious page that auto-submits a hidden form to the vulnerable admin endpoint; when a logged-in administrator visits, the injected SQL executes server-side, enabling time-based blind extraction of database contents.
**Insight:** Removed/abandoned plugins still installed on production are high-value: pull their source from the SVN trunk and grep for direct $_POST concatenation into $wpdb queries, especially in admin-ajax/reorder handlers.