CVE-2024-10341

Executive Summary

CVE-2024-10341 is a critical SQL Injection vulnerability discovered in the League of Legends Shortcodes WordPress plugin, affecting versions up to and including 1.0.1. The flaw resides in the plugin's shortcode implementation, where user-supplied parameters are not properly escaped and SQL queries are not adequately prepared. This allows authenticated attackers with contributor-level permissions or higher to inject arbitrary SQL commands into existing queries, potentially leading to the extraction of sensitive information from the WordPress database, such as user credentials, session tokens, and private content.

As a WordPress ecosystem vulnerability, this issue does not affect the underlying web server (Apache/Nginx) but is entirely contained within the plugin's code. The CVSS score of 6.5 (Medium) reflects the requirement for authentication, but the potential for data exfiltration makes it a high-priority target for red team operations and blue team detection.

Supply Chain & Package Security

This vulnerability is specific to the League of Legends Shortcodes WordPress plugin, which is distributed via the WordPress plugin repository. No official patch has been released as of the latest analysis. Organizations using this plugin should treat it as a supply chain risk and consider immediate removal or strict access controls until a patch is available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires contributor-level or higher authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium (6.5). While authentication is required, the low complexity and high confidentiality impact make this a serious threat for WordPress sites with multiple user roles.

Deep Dive & Mechanics

The vulnerability exists in the shortcode handler of the plugin. WordPress shortcodes are parsed and executed when a post or page is rendered. The plugin registers a shortcode (e.g., [lol_shortcode]) that accepts user-supplied parameters. Due to insufficient input escaping and lack of prepared statements, the parameter value is directly concatenated into an SQL query.

Example vulnerable code snippet (conceptual):

function lol_shortcode_handler($atts) {
    global $wpdb;
    $id = $atts['id'];
    $results = $wpdb->get_results("SELECT * FROM wp_posts WHERE ID = $id");
    // ...
}
add_shortcode('lol_shortcode', 'lol_shortcode_handler');

An attacker with contributor-level access can create a post containing the shortcode with a malicious id parameter:

[lol_shortcode id="1 UNION SELECT user_login, user_pass FROM wp_users"]

When the post is viewed, the SQL query becomes:

SELECT * FROM wp_posts WHERE ID = 1 UNION SELECT user_login, user_pass FROM wp_users

This returns user credentials (password hashes) alongside normal post data, which can then be extracted via the plugin's output.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.0.1):

function lol_shortcode_handler($atts) {
    global $wpdb;
    $id = $atts['id'];
    // Direct concatenation - vulnerable
    $results = $wpdb->get_results("SELECT * FROM wp_posts WHERE ID = $id");
    // ...
}

Patched Code (hypothetical fix):

function lol_shortcode_handler($atts) {
    global $wpdb;
    $id = intval($atts['id']); // Cast to integer
    // Use prepared statement
    $results = $wpdb->get_results($wpdb->prepare("SELECT * FROM wp_posts WHERE ID = %d", $id));
    // ...
}

The patched version uses intval() to ensure the parameter is an integer and $wpdb->prepare() to safely bind the value, preventing SQL injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with League of Legends Shortcodes plugin <= 1.0.1.
• A user account with contributor-level or higher permissions.

Exploitation Steps:

1. Identify the shortcode: The plugin registers a shortcode (e.g., [lol_shortcode]). Determine the exact shortcode name by inspecting the plugin source or using a WordPress debug tool.

2. Craft malicious post: As a contributor, create a new post with the following shortcode:

   [lol_shortcode id="1 UNION SELECT user_login, user_pass FROM wp_users"]
   

3. Trigger the exploit: View the published post. The SQL injection will execute, and the output will include user credentials.

4. Extract data: The plugin's output may display the injected data. If not, use time-based or error-based techniques to exfiltrate data.

Example SQL injection payloads:

• Extract all users: 1 UNION SELECT user_login, user_pass FROM wp_users
• Extract admin email: 1 UNION SELECT user_email, user_pass FROM wp_users WHERE user_login='admin'
• Time-based blind: 1 AND SLEEP(5)

Blue Team

Detection and Response:

1. Monitor for suspicious shortcodes: Look for posts containing shortcodes with unusual parameters, especially SQL keywords like UNION, SELECT, FROM, or SLEEP.

2. Audit user activity: Check for posts created by contributor-level users that contain the vulnerable shortcode.

3. Database monitoring: Enable SQL query logging and look for unexpected UNION or OR clauses in queries involving the wp_posts table.

4. Immediate containment: If exploitation is suspected, disable the plugin immediately and revoke contributor-level access for untrusted users.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/league-of-legends-shortcodes/ (presence of the plugin)
• Database entries: Posts containing shortcodes with SQL injection patterns (e.g., [lol_shortcode id="1 UNION SELECT..."])
• Log entries: SQL errors in WordPress debug log (if enabled) showing malformed queries
• Network traffic: HTTP requests to WordPress posts with unusual query parameters
• User accounts: Unexpected creation of new admin-level users (if attacker escalates privileges)

Detection Engineering

YARA Rule

rule CVE_2024_10341_League_of_Legends_Shortcodes_SQLi {
    meta:
        description = "Detects SQL injection attempts against League of Legends Shortcodes plugin"
        author = "Valters IT"
        date = "2024-10-27"
        cve = "CVE-2024-10341"
    strings:
        $shortcode = /\[lol_shortcode[^\]]*id\s*=\s*["'][^"']*UNION/i
        $sqli_pattern = /UNION\s+SELECT|OR\s+['"][^'"]*['"]\s*=\s*['"][^'"]*['"]/i
    condition:
        $shortcode or $sqli_pattern
}

Sigma Rule

title: CVE-2024-10341 SQL Injection via League of Legends Shortcodes
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts in WordPress posts containing the vulnerable shortcode
author: Valters IT
date: 2024/10/27
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: GET
        http.url|contains: 
            - "/?p="
            - "/?page_id="
        http.url|re: '\[lol_shortcode[^\]]*id\s*=\s*["\'][^"\']*UNION'
    condition: selection
falsepositives:
    - Legitimate use of the shortcode with numeric IDs only
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-10341 SQL Injection - League of Legends Shortcodes";
    flow:to_server,established;
    content:"[lol_shortcode";
    nocase;
    pcre:"/\[lol_shortcode[^\]]*id\s*=\s*[\"'][^\"']*UNION/i";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Review and revoke contributor-level access for untrusted users.
3. Audit database for any signs of data exfiltration (e.g., unexpected user accounts, modified posts).

Long-term Fix:

• Replace the vulnerable plugin with an alternative or apply a custom patch using prepared statements and input validation as shown in the patched code example.

Workaround:

• Use a Web Application Firewall (WAF) to block SQL injection patterns in shortcode parameters.
• Restrict shortcode usage to administrators only via WordPress capabilities.

Valters IT Signature:

CVE-2024-10341 | League of Legends Shortcodes SQLi | CVSS 6.5 | Unpatched | Valters IT