CVE-2024-9879

Executive Summary

CVE-2024-9878 is a critical SQL Injection vulnerability found in the Melapress File Monitor WordPress plugin before version 2.1.1. This flaw allows authenticated administrators to inject arbitrary SQL commands via an unsanitized and unescaped parameter. While the CVSS score is listed as 0.0 in the NVD data (likely a placeholder), the actual risk is high due to the potential for complete database compromise, including extraction of user credentials, posts, and configuration data. The vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx).

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who installed the plugin via the WordPress admin dashboard or directly from the repository are affected. There is no known compromise of the plugin’s supply chain; the vulnerability is a code-level flaw introduced by the developer.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is performed over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – The attacker must have admin-level access to the WordPress site.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Potential to modify or delete data.
• Availability (A): High (H) – Potential to disrupt database operations.

CVSS Score: 7.2 (High) – Based on the vector above.

Deep Dive & Mechanics

The vulnerability exists in the Melapress File Monitor plugin’s administrative interface. The plugin fails to properly sanitize and escape a parameter (likely a filter or sorting parameter) before incorporating it into a SQL query. This allows an authenticated admin to break out of the intended SQL syntax and execute arbitrary commands.

The vulnerable code likely resembles:

$order = $_GET['order'];
$query = "SELECT * FROM wp_melapress_logs ORDER BY " . $order;

The fix in version 2.1.1 likely uses prepared statements or proper escaping:

$order = sanitize_sql_orderby( $_GET['order'] );
$query = $wpdb->prepare( "SELECT * FROM wp_melapress_logs ORDER BY %s", $order );

Vulnerable vs. Patched Code

Vulnerable (before 2.1.1):

$order = $_GET['order'];
$results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}melapress_logs ORDER BY $order" );

Patched (2.1.1+):

$order = sanitize_sql_orderby( $_GET['order'] );
$results = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}melapress_logs ORDER BY %s", $order ) );

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials to a WordPress site running Melapress File Monitor < 2.1.1.
• The vulnerable parameter (e.g., order) must be identified in the plugin’s admin pages.

Exploitation Steps:

1. Log in as an admin.
2. Navigate to the Melapress File Monitor admin page (e.g., /wp-admin/admin.php?page=melapress-file-monitor).
3. Inject SQL via the vulnerable parameter:

   /wp-admin/admin.php?page=melapress-file-monitor&order=id; SELECT user_login, user_pass FROM wp_users--
   

4. The injected SQL will be executed, potentially dumping user credentials.

Proof of Concept (PoC):

-- Extract admin hashes
id; SELECT user_login, user_pass FROM wp_users WHERE user_login='admin'--

Blue Team

Detection:

• Monitor for unusual SQL queries in database logs.
• Look for admin users accessing the Melapress File Monitor page with abnormal parameters.
• Use the Sigma rule below to detect suspicious order parameters.

Hunting:

• Search web server logs for requests containing SQL keywords (e.g., SELECT, UNION, --) in the order parameter.
• Check for unexpected database errors in WordPress debug logs.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /wp-admin/admin.php?page=melapress-file-monitor&order=* containing SQL syntax.
• File: Modified or new files in the WordPress uploads directory (if the attacker used INTO OUTFILE).
• Database: Unexpected entries in the wp_melapress_logs table or new admin users.
• Logs: Database error logs showing SQL syntax errors.

Detection Engineering

YARA Rule

rule CVE_2024_9878_Melapress_SQLi {
    meta:
        description = "Detects SQL injection attempts against Melapress File Monitor plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-9878"
    strings:
        $sqli1 = "order=" nocase
        $sqli2 = "SELECT" nocase
        $sqli3 = "UNION" nocase
        $sqli4 = "--" nocase
        $sqli5 = "/*" nocase
    condition:
        all of ($sqli*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-9878 - Melapress File Monitor SQL Injection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against the Melapress File Monitor plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'order='
            - 'SELECT'
            - 'UNION'
            - '--'
            - '/*'
    condition: selection
falsepositives:
    - Legitimate admin usage with complex sorting
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-9878 - Melapress File Monitor SQL Injection Attempt"; flow:to_server,established; content:"/wp-admin/admin.php"; http_uri; content:"page=melapress-file-monitor"; http_uri; content:"order="; http_uri; pcre:"/order=[^&]*(SELECT|UNION|--|\/\*)/Ui"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Update the Melapress File Monitor plugin to version 2.1.1 or later.
2. If immediate update is not possible, restrict admin access to trusted IPs only.
3. Review and rotate all WordPress admin passwords.

Long-term:

1. Implement a Web Application Firewall (WAF) with SQL injection rules.
2. Regularly audit WordPress plugins for known vulnerabilities.
3. Use a security plugin that monitors file changes and database queries.

Patch Details: The patch is available in version 2.1.1 of the Melapress File Monitor plugin. Update via the WordPress admin dashboard or download from the WordPress plugin repository.

Valters IT
Securing Digital Frontiers