Summary
A SQL injection in the Commerce TotalRevenue widget can lead to remote code execution through a chain of four vulnerabilities:
-
SQL Injection -- The TotalRevenue stat interpolates unsanitized widget settings directly into a sprintf-based SQL Expression. Any control panel user can create any widget type without permission checks.
-
PDO Multi-Statement Queries -- PHP PDO MySQL enables CLIENT_MULTI_STATEMENTS by default. Neither Yii2 nor Craft CMS disables it. This allows stacking an INSERT statement after the injected SELECT , writing a maliciously serialized PHP object into the queue table.
-
Unrestricted unserialize() -- The yii2-queue PhpSerializer calls unserialize() with no allowed_classes restriction on every queue job. When the queue consumer processes the injected job, it instantiates the attacker-controlled object.
-
Gadget Chain (FileCookieJar) -- GuzzleHttp\Cookie\FileCookieJar (a standard Guzzle dependency) has an unguarded __destruct() method that calls file_put_contents(). The attacker’s serialized payload writes a PHP webshell to the server’s webroot. PHP tags survive json_encode() because Guzzle uses options=0 (no JSON_HEX_TAG).
The complete chain requires 3 HTTP requests and achieves arbitrary command execution as the PHP process user. Queue processing is triggered via GET /actions/queue/run, an endpoint that requires no authentication ($allowAnonymous = ['run']).
RCE Exploitation Steps
- Authenticate as any control panel user
- POST to
/admin/actions/dashboard/create-widget with stacked SQL injection:
settings[type] contains the stacked INSERT with the serialized gadget chain- Response: HTTP 500 (expected -- INSERT already committed)
- Trigger queue processing:
GET /actions/queue/run
- Queue consumer deserializes the gadget chain
FileCookieJar::__destruct() writes webshell to webroot- Access the webshell:
GET /poc_rce.php?c=id
- Response:
uid=1000(home) gid=1000(home) groups=1000(home)
References
6d2d24b
RajChowdhury240 Reporter
rlarabee Reporter
Summary
A SQL injection in the Commerce TotalRevenue widget can lead to remote code execution through a chain of four vulnerabilities:
SQL Injection -- The TotalRevenue stat interpolates unsanitized widget settings directly into a sprintf-based SQL Expression. Any control panel user can create any widget type without permission checks.
PDO Multi-Statement Queries -- PHP
PDO MySQLenablesCLIENT_MULTI_STATEMENTSby default. Neither Yii2 nor Craft CMS disables it. This allows stacking an INSERT statement after the injected SELECT , writing a maliciously serialized PHP object into the queue table.Unrestricted
unserialize()-- The yii2-queue PhpSerializer callsunserialize()with no allowed_classes restriction on every queue job. When the queue consumer processes the injected job, it instantiates the attacker-controlled object.Gadget Chain (FileCookieJar) --
GuzzleHttp\Cookie\FileCookieJar(a standard Guzzle dependency) has an unguarded__destruct()method that callsfile_put_contents(). The attacker’s serialized payload writes a PHP webshell to the server’s webroot. PHP tags survivejson_encode()because Guzzle usesoptions=0(noJSON_HEX_TAG).The complete chain requires 3 HTTP requests and achieves arbitrary command execution as the PHP process user. Queue processing is triggered via GET
/actions/queue/run, an endpoint that requires no authentication ($allowAnonymous = ['run']).RCE Exploitation Steps
/admin/actions/dashboard/create-widgetwith stacked SQL injection:settings[type]contains the stacked INSERT with the serialized gadget chainGET /actions/queue/runFileCookieJar::__destruct()writes webshell to webrootGET /poc_rce.php?c=iduid=1000(home) gid=1000(home) groups=1000(home)References
6d2d24b