CVE-2024-9130

Executive Summary

CVE-2024-9130 is a critical time-based SQL Injection vulnerability discovered in the GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress. The flaw resides in the order parameter within the Legacy View mode, affecting all versions up to and including 3.16.1. An authenticated attacker with GiveWP Manager-level access or higher can exploit this vulnerability to inject arbitrary SQL queries into existing database queries, leading to the extraction of sensitive information such as user credentials, donation records, and other confidential data. The vulnerability is classified as high severity with a CVSS score of 7.2, and while the EPSS score is currently 0.0%, the potential for exploitation remains significant due to the widespread use of the GiveWP plugin across thousands of WordPress sites.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the GiveWP plugin. It does not affect NPM, PyPI, Go, or Ruby packages. However, organizations using GiveWP should treat this as a critical supply chain risk, as the plugin is a third-party component integrated into WordPress sites. The lack of a publicly available patch or advisory from the vendor increases the urgency for defensive measures.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – Requires GiveWP Manager-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high privileges required reduce the attack surface, but once an attacker gains Manager-level access, the impact is severe, allowing full database compromise.

Deep Dive & Mechanics

The vulnerability exists in the GiveWP plugin's Legacy View mode, specifically in the handling of the order parameter used for sorting donation records. The plugin fails to properly escape user-supplied input and does not prepare the SQL query adequately, allowing an attacker to inject malicious SQL code.

Root Cause: The order parameter is directly concatenated into an SQL query without parameterization or proper sanitization. For example, a vulnerable query might look like:

SELECT * FROM wp_give_donations ORDER BY {user_input} ASC

An attacker can manipulate the order parameter to inject a time-based blind SQL injection payload, such as:

(SELECT IF(1=1, SLEEP(5), 'a'))

This causes the database to delay its response, allowing the attacker to infer information bit by bit.

Attack Flow:

1. Authenticate as a user with GiveWP Manager-level access.
2. Navigate to the Legacy View mode (e.g., /wp-admin/edit.php?post_type=give_forms&page=give-donations&view=legacy).
3. Inject malicious SQL into the order parameter.
4. Observe response times to extract data.

Vulnerable vs. Patched Code

Vulnerable Code (<= 3.16.1):

// In a file like includes/admin/donations/class-donations-list-table.php
$order = isset($_GET['order']) ? $_GET['order'] : 'DESC';
$query = "SELECT * FROM {$wpdb->give_donations} ORDER BY {$order}";
$results = $wpdb->get_results($query);

Patched Code (Hypothetical):

$order = isset($_GET['order']) ? strtoupper($_GET['order']) : 'DESC';
$allowed_orders = array('ASC', 'DESC');
if (!in_array($order, $allowed_orders)) {
    $order = 'DESC';
}
$query = $wpdb->prepare("SELECT * FROM {$wpdb->give_donations} ORDER BY %s", $order);
$results = $wpdb->get_results($query);

The patch would enforce a whitelist of allowed values and use prepared statements to prevent injection.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install WordPress with GiveWP plugin version 3.16.1.
2. Create a user with GiveWP Manager-level access.
3. Ensure Legacy View mode is enabled.

Exploitation: Since no public exploit code is available, a manual time-based SQL injection can be performed using tools like sqlmap or custom scripts.

Example using sqlmap:

sqlmap -u "http://target/wp-admin/edit.php?post_type=give_forms&page=give-donations&view=legacy&order=DESC" --cookie="wordpress_logged_in_xxx=..." --data="order=DESC" --dbms=mysql --technique=T --level=5 --risk=3

Manual payload example:

GET /wp-admin/edit.php?post_type=give_forms&page=give-donations&view=legacy&order=(SELECT%20IF(1=1,SLEEP(5),'a')) HTTP/1.1
Host: target
Cookie: wordpress_logged_in_xxx=...

Blue Team

Detection:

• Monitor for unusual order parameter values in GiveWP admin pages.
• Look for SQL keywords like SLEEP, BENCHMARK, or IF in HTTP requests.
• Alert on response delays exceeding normal thresholds.

Hunting: Search logs for patterns:

order=(SELECT%20*
order=IF(
order=SLEEP(

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/edit.php with page=give-donations and view=legacy containing suspicious order parameter values.
• Logs: Database query logs showing unexpected ORDER BY clauses with subqueries.
• System: Unusual database load or slow response times from the WordPress admin panel.

Detection Engineering

YARA Rule

rule CVE_2024_9130_GiveWP_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting GiveWP order parameter"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-9130"
    strings:
        $s1 = "order=" nocase
        $s2 = "SLEEP(" nocase
        $s3 = "BENCHMARK(" nocase
        $s4 = "IF(" nocase
        $s5 = "give-donations" nocase
        $s6 = "view=legacy" nocase
    condition:
        all of ($s1, $s5, $s6) and any of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-9130 GiveWP SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against GiveWP order parameter
author: Valters IT
date: 2024-10-27
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'order=SLEEP('
            - 'order=BENCHMARK('
            - 'order=IF('
        cs-uri-stem|contains: '/wp-admin/edit.php'
        cs-uri-query|contains|all:
            - 'page=give-donations'
            - 'view=legacy'
    condition: selection
falsepositives:
    - Legitimate use of sleep/benchmark functions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9130 GiveWP SQL Injection Attempt"; flow:to_server,established; content:"/wp-admin/edit.php"; http_uri; content:"page=give-donations"; http_uri; content:"view=legacy"; http_uri; content:"order="; http_uri; pcre:"/order=(SELECT|SLEEP|BENCHMARK|IF)/iU"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable Legacy View mode in GiveWP settings if possible.
2. Short-term: Restrict GiveWP Manager-level access to trusted users only.
3. Long-term: Apply a patch from the vendor once available, or implement a Web Application Firewall (WAF) rule to block malicious order parameter values.
4. Monitoring: Enable detailed logging for all GiveWP admin actions and review regularly.

Valters IT
Securing Digital Frontiers