CVE-2024-12311

Executive Summary

CVE-2024-12311 is a critical SQL Injection vulnerability discovered in the Email Subscribers by Icegram Express WordPress plugin (versions before 5.7.44). This flaw allows authenticated administrators to inject arbitrary SQL commands via an unsanitized and unescaped parameter used in a database query. Successful exploitation could lead to complete database compromise, including the extraction of sensitive user data, credential theft, and potential lateral movement within the WordPress ecosystem. The vulnerability is classified as a WordPress plugin security issue and does not involve the underlying web server software (Apache/Nginx). No public proof-of-concept (PoC) or exploit code has been released at this time, but the risk remains high due to the privileged access required and the potential for privilege escalation.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Organizations using this plugin should verify their version and apply the patch immediately. There is no associated NPM, PyPI, Go, or Ruby package.

CVSS Breakdown & Threat Level

CVSS Score: 8.8 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – An administrator-level account is needed.
• User Interaction (UI): None – No user action is required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Full database read access is possible.
• Integrity (I): High – Database records can be modified or deleted.
• Availability (A): High – Database availability can be impacted.

Threat Level: High. Although the attack requires admin privileges, a compromised admin account or a malicious insider can leverage this to fully control the WordPress database.

Deep Dive & Mechanics

The vulnerability resides in the Email Subscribers by Icegram Express plugin, specifically in a function that processes administrative requests. The plugin fails to sanitize and escape a parameter before incorporating it into a SQL statement. This allows an authenticated administrator to inject malicious SQL code.

Root Cause: The plugin uses a parameter (likely a $_GET or $_POST variable) directly in a SQL query without proper validation or parameterized queries. For example, a vulnerable code snippet might look like:

$id = $_GET['id'];
$result = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}email_subscribers WHERE id = $id" );

This direct concatenation allows an attacker to break out of the intended SQL syntax and execute arbitrary commands.

Attack Vector: An admin user can craft a malicious request to the vulnerable endpoint, injecting SQL commands. For instance, a request like:

GET /wp-admin/admin-ajax.php?action=icegram_express_action&id=1 UNION SELECT user_login,user_pass FROM wp_users

could extract user credentials.

Impact: Full database compromise, including:

• Extraction of all WordPress user credentials (hashed passwords).
• Modification of plugin settings.
• Insertion of malicious admin users.
• Potential for server-side request forgery (SSRF) or file inclusion if the database supports such operations.

Vulnerable vs. Patched Code

Vulnerable Code (before 5.7.44):

// Vulnerable: Direct concatenation without sanitization
$id = $_GET['id'];
$results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}email_subscribers WHERE id = $id" );

Patched Code (version 5.7.44):

// Patched: Using prepared statement with parameterized query
$id = intval( $_GET['id'] );
$results = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}email_subscribers WHERE id = %d", $id ) );

The patch uses intval() to ensure the input is an integer and $wpdb->prepare() to safely bind the parameter, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with the vulnerable plugin (version < 5.7.44).
• Admin credentials (e.g., admin:password).

Steps:

1. Log in as an admin.
2. Identify the vulnerable endpoint (e.g., via plugin source code analysis or fuzzing).
3. Craft a malicious request using a tool like curl or Burp Suite.

Example Exploit Request:

curl -X GET "http://target.com/wp-admin/admin-ajax.php?action=icegram_express_action&id=1 UNION SELECT user_login,user_pass FROM wp_users" \
  -H "Cookie: wordpress_logged_in_<hash>=admin|..."

Expected Output: The response will include the union query results, revealing usernames and password hashes.

Advanced Exploitation:

• Use INTO OUTFILE to write a web shell (if MySQL file privileges are enabled).
• Extract the WordPress salt keys to forge authentication cookies.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual SQL queries in database logs.
• Look for admin requests to admin-ajax.php with suspicious parameters (e.g., UNION, SELECT, INTO).
• Use Web Application Firewall (WAF) rules to block SQL injection patterns.

Defense:

• Immediately upgrade to version 5.7.44 or later.
• Restrict admin access to trusted IPs.
• Implement database activity monitoring.
• Use a WordPress security plugin (e.g., Wordfence) to detect malicious requests.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /wp-admin/admin-ajax.php with parameters containing SQL keywords (e.g., UNION, SELECT, INTO).
• Unusual response sizes or error messages containing SQL syntax.

File IOCs:

• Modified plugin files (e.g., email-subscribers/email-subscribers.php).
• Unexpected files in the WordPress uploads directory (e.g., .php files).

Database IOCs:

• New or modified admin users.
• Unusual entries in the wp_options table.
• Queries in the MySQL general log containing UNION or INTO OUTFILE.

Detection Engineering

YARA Rule

rule CVE_2024_12311_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-12311 in Email Subscribers by Icegram Express"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12311"
    strings:
        $suspicious_param = /[?&]id\s*=\s*.*(?:UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/ nocase
        $plugin_path = /\/wp-admin\/admin-ajax\.php/
    condition:
        $plugin_path and $suspicious_param
}

Sigma Rule

title: CVE-2024-12311 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against the Email Subscribers by Icegram Express plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-12311
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'id='
            - 'UNION'
            - 'SELECT'
            - 'INTO'
        cs-uri-stem|contains: '/wp-admin/admin-ajax.php'
    condition: selection
falsepositives:
    - Legitimate admin actions with similar parameters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-12311 SQL Injection Attempt - Email Subscribers by Icegram Express";
    flow:to_server,established;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"id="; http_uri;
    pcre:"/(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i";
    sid:10000001;
    rev:1;
    reference:cve,2024-12311;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the plugin to version 5.7.44 or later from the WordPress plugin repository.
2. Verify no unauthorized changes have been made to the database (e.g., new admin users).
3. Rotate all WordPress admin passwords and consider resetting user sessions.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Regularly audit WordPress plugins and themes for vulnerabilities.
• Use a security plugin (e.g., Wordfence, Sucuri) for real-time monitoring.
• Enforce the principle of least privilege for WordPress admin accounts.

Patch Verification:

• Check the plugin version in wp-content/plugins/email-subscribers/email-subscribers.php.
• Confirm the presence of $wpdb->prepare() in the patched code.

Report generated by Valters IT DevSecOps Intelligence Unit.