CVE-2024-12023

Executive Summary

CVE-2024-12023 is a SQL Injection vulnerability in the FULL – Cliente WordPress plugin, affecting versions 3.1.5 through 3.1.25. The flaw resides in the formId parameter, which is insufficiently sanitized and prepared before being used in SQL queries. An authenticated attacker with Subscriber-level access or higher can exploit this to extract sensitive database information. The exploit is only viable when the PRO version of the plugin is active, alongside Elementor Pro and Elementor CRM. The CVSS score is 6.5 (Medium), and no public proof-of-concept or patch details are currently available.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires Subscriber-level authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Impact confined to the vulnerable component.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The requirement for authentication and specific plugin combinations reduces the attack surface, but the potential for sensitive data exfiltration is significant.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection in the WordPress plugin ecosystem. The formId parameter, likely used to fetch form data from the database, is passed directly into an SQL query without proper escaping or parameterized preparation. The plugin uses $wpdb->prepare() incorrectly or not at all, allowing an attacker to inject arbitrary SQL.

The attack flow:

1. An authenticated user (Subscriber or higher) sends a crafted request to a vulnerable endpoint, e.g., /wp-admin/admin-ajax.php?action=full_cliente_get_form&formId=1 UNION SELECT ....
2. The plugin processes the formId value and concatenates it into an SQL query.
3. The injected SQL executes, returning data from other tables (e.g., wp_users, wp_options).
4. The attacker receives the extracted data in the response.

The dependency on Elementor Pro and Elementor CRM suggests the vulnerable code is part of a CRM integration feature that only loads when those plugins are active.

Vulnerable vs. Patched Code

Vulnerable Code (conceptual):

$form_id = $_GET['formId'];
$results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}full_forms WHERE id = $form_id" );

Patched Code (expected):

$form_id = intval( $_GET['formId'] );
$results = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}full_forms WHERE id = %d", $form_id ) );

The patch must use intval() or absint() to cast the parameter to an integer, and $wpdb->prepare() with a placeholder to ensure safe query construction.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with FULL – Cliente plugin (v3.1.5–3.1.25) activated.
• Elementor Pro and Elementor CRM activated.
• Valid user account with Subscriber role or higher.

Exploitation Steps:

1. Obtain a valid session cookie for the authenticated user.
2. Identify the vulnerable AJAX action (e.g., full_cliente_get_form).
3. Craft a SQL injection payload in the formId parameter:

   GET /wp-admin/admin-ajax.php?action=full_cliente_get_form&formId=1 UNION SELECT user_login,user_pass,user_email FROM wp_users
   

4. Send the request with the session cookie.
5. Parse the response for extracted data.

Example cURL command:

curl -b "wordpress_logged_in_xxx=..." "http://target/wp-admin/admin-ajax.php?action=full_cliente_get_form&formId=1 UNION SELECT user_login,user_pass,user_email FROM wp_users"

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual SQL error messages in logs.
• Look for requests to admin-ajax.php with action=full_cliente_get_form and suspicious formId values (e.g., containing UNION, SELECT, FROM).
• Use WAF rules to block SQL injection patterns in the formId parameter.

Defense:

• Immediately update the plugin if a patch becomes available.
• Disable the FULL – Cliente plugin or its PRO features if not essential.
• Restrict admin-ajax.php access to authenticated users only.
• Implement input validation and parameterized queries in custom code.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with action=full_cliente_get_form and formId containing SQL keywords.
  • Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified plugin files (e.g., wp-content/plugins/full-cliente/...) with injected backdoors.
• Log IOCs:
  • Repeated failed SQL queries in MySQL logs.
  • Unauthorized access to wp_users or wp_options tables.

Detection Engineering

YARA Rule

rule CVE_2024_12023_SQLi_WordPress {
    meta:
        description = "Detects SQL injection attempts targeting FULL – Cliente plugin formId parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12023"
    strings:
        $s1 = "formId=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "FROM" nocase
        $s5 = "admin-ajax.php" nocase
    condition:
        all of ($s1, $s5) and 2 of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-12023 SQL Injection via formId Parameter
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against FULL – Cliente plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'action=full_cliente_get_form'
            - 'formId='
        cs-uri-query|re: '(UNION|SELECT|FROM|WHERE|OR 1=1|--)'
    condition: selection
falsepositives:
    - Legitimate use of form IDs containing similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12023 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=full_cliente_get_form"; http_uri; content:"formId="; http_uri; pcre:"/(UNION|SELECT|FROM|WHERE|OR\s+1=1|--)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the FULL – Cliente plugin or its PRO features until a patch is available.
2. If the plugin is essential, restrict access to admin-ajax.php using .htaccess or a WAF.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the official patch from the plugin vendor when released.
• Ensure all WordPress plugins are updated to the latest versions.
• Implement a Web Application Firewall (WAF) with SQL injection rules.

Workaround:

• Use a security plugin like Wordfence to block malicious requests.
• Manually patch the vulnerable code by adding intval() and $wpdb->prepare() as shown in the patched code section.

Valters IT
Securing Digital Frontiers