CVE-2024-54284

Executive Summary

CVE-2024-54284 is a critical SQL Injection vulnerability discovered in the SeedProd Pro WordPress plugin, specifically in the seedprod-coming-soon-pro component. This flaw allows an unauthenticated attacker to inject arbitrary SQL commands into the database, potentially leading to data exfiltration, modification, or complete compromise of the WordPress site. The vulnerability affects all versions prior to 6.18.13. Given the plugin's widespread use for coming-soon and maintenance mode pages, the attack surface is significant. No public proof-of-concept (PoC) or exploit code has been released at this time, but the risk remains high due to the ease of exploitation and the plugin's privileged database access.

Supply Chain & Package Security

This vulnerability resides in a commercial WordPress plugin distributed via the SeedProd website and the WordPress plugin repository. Users who obtained the plugin through unofficial channels or outdated license keys are at heightened risk. The plugin's update mechanism should be verified to ensure only signed and authenticated updates are applied. Organizations should audit their plugin inventory for SeedProd Pro versions below 6.18.13 and treat any compromised site as a potential supply chain incident.

CVSS Breakdown & Threat Level

• CVSS Score: 7.6 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability is trivially exploitable by any remote attacker without authentication. Successful exploitation can lead to full database compromise, including user credentials, post content, and configuration data. The high impact across all three security pillars justifies the critical severity rating.

Deep Dive & Mechanics

The vulnerability stems from improper neutralization of special elements used in an SQL command within the SeedProd Pro plugin. The plugin likely constructs SQL queries using user-supplied input (e.g., via HTTP parameters or cookies) without proper sanitization or parameterized statements. An attacker can inject SQL metacharacters such as single quotes ('), double dashes (--), or comment sequences (/*) to break out of the intended query context and execute arbitrary SQL.

The vulnerable code is likely found in the plugin's database interaction layer, possibly in functions handling AJAX requests, shortcode processing, or template rendering. Since the plugin manages coming-soon pages, the injection point could be in the page ID, template name, or other user-controllable parameters.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-6.18.13):

// Hypothetical vulnerable function
function seedprod_get_page($page_id) {
    global $wpdb;
    $result = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}seedprod_pages WHERE id = $page_id");
    return $result;
}

Patched Code (6.18.13+):

// Patched version using prepared statement
function seedprod_get_page($page_id) {
    global $wpdb;
    $result = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}seedprod_pages WHERE id = %d", $page_id));
    return $result;
}

The patch replaces direct string interpolation with a prepared statement ($wpdb->prepare), which ensures the input is treated as data, not executable code. This is the standard mitigation for SQL injection in WordPress.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress with SeedProd Pro version 6.18.12.
2. Activate the plugin and configure a coming-soon page.
3. Identify the vulnerable parameter (e.g., page_id in an AJAX endpoint).

Exploitation Steps:

1. Send a crafted HTTP request to the vulnerable endpoint:

   GET /wp-admin/admin-ajax.php?action=seedprod_get_page&page_id=1 UNION SELECT user_login,user_pass FROM wp_users-- HTTP/1.1
   Host: target-site.com
   

2. The injected SQL will return user credentials from the wp_users table.
3. Extract password hashes and attempt offline cracking.

Note: No public exploit code is available; the above is a hypothetical example based on common patterns.

Blue Team (Defensive)

Detection:

• Monitor for SQL error messages in logs (e.g., "You have an error in your SQL syntax").
• Alert on unusual HTTP requests containing SQL keywords (UNION, SELECT, --, /*).
• Use WAF rules to block requests with SQL metacharacters in query parameters.

Hunting:

• Search for seedprod in database query logs.
• Look for unexpected UNION or OR 1=1 patterns in web server access logs.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing UNION SELECT or OR '1'='1' in parameters.
  • Unusual database error messages in HTTP responses.
• Host:
  • Unexpected database entries in wp_seedprod_pages table.
  • Modified plugin files (check file integrity).
• Logs:
  • MySQL error log entries with syntax error near UNION.
  • Web server access logs with SQL injection patterns.

Detection Engineering

YARA Rule

rule CVE_2024_54284_SQLi_SeedProd {
    meta:
        description = "Detects SQL injection attempts targeting SeedProd Pro plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-54284"
    strings:
        $sqli1 = /seedprod.*UNION.*SELECT/i
        $sqli2 = /seedprod.*OR\s+['"]\d+['"]\s*=\s*['"]\d+['"]/i
        $sqli3 = /seedprod.*--\s*$/m
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt Against SeedProd Pro
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection patterns in HTTP requests targeting SeedProd Pro plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'seedprod'
            - 'UNION'
            - 'SELECT'
            - 'OR '
            - '--'
    condition: selection
falsepositives:
    - Legitimate use of UNION in custom queries (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-54284 SQL Injection Attempt - SeedProd Pro"; flow:to_server,established; content:"seedprod"; http_uri; nocase; content:"UNION"; http_uri; nocase; distance:0; content:"SELECT"; http_uri; nocase; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Update SeedProd Pro to version 6.18.13 or later. If update is unavailable, disable the plugin until a patch is applied.
2. Compensating Controls: Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns. Use database user with minimal privileges (e.g., no DROP or CREATE).
3. Monitoring: Enable detailed logging for database queries and web server access. Set up alerts for SQL error messages.
4. Long-term: Conduct a code review of all WordPress plugins for similar injection flaws. Adopt parameterized queries universally.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert