CVE-2025-10310

Executive Summary

CVE-2025-10310 is a critical SQL Injection vulnerability discovered in the Rich Snippet Site Report plugin for WordPress, affecting all versions up to and including 2.0.0105. The flaw resides in the plugin's handling of the last parameter, where insufficient input escaping and lack of prepared statements allow an unauthenticated attacker to inject arbitrary SQL queries. This can lead to the extraction of sensitive information from the WordPress database, including user credentials, session tokens, and other confidential data. The attack can also be triggered via Cross-Site Request Forgery (CSRF), increasing the attack surface. As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem and does not involve Apache or Nginx server software.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who have installed the plugin via the WordPress admin dashboard or through automated deployment tools are at risk. The lack of a known patch or update from the vendor means that the supply chain is currently compromised, and users must rely on manual mitigation until an official fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must perform an action (e.g., click a link) for CSRF exploitation.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Sensitive data can be extracted.
• Integrity (I): None – Data cannot be modified.
• Availability (A): None – Service availability is not impacted.

Threat Level: Medium. While the CVSS score is moderate, the potential for data exfiltration and the ease of exploitation via CSRF elevate the risk for WordPress sites using this plugin.

Deep Dive & Mechanics

The vulnerability exists in the rich-snippet-site-report.php file (or similar) where the plugin processes the last parameter. The code likely uses a function like $_GET['last'] or $_POST['last'] directly in an SQL query without proper sanitization or parameterized queries. For example:

$last = $_GET['last'];
$query = "SELECT * FROM wp_reports WHERE id > " . $last;

This allows an attacker to inject SQL commands by appending malicious payloads to the last parameter. Since the plugin does not use prepared statements, the injected SQL is executed directly against the database.

The CSRF vector means that an attacker can craft a malicious link or form that, when clicked by an authenticated admin, will execute the SQL injection in the context of that admin's session. This bypasses the need for direct unauthenticated access to the vulnerable endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (Example):

$last = $_GET['last'];
$results = $wpdb->get_results( "SELECT * FROM {$wpdb->prefix}reports WHERE id > $last" );

Patched Code (Hypothetical):

$last = intval( $_GET['last'] );
$results = $wpdb->get_results( $wpdb->prepare( "SELECT * FROM {$wpdb->prefix}reports WHERE id > %d", $last ) );

The patched version uses intval() to ensure the input is an integer and $wpdb->prepare() to safely parameterize the query, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with the Rich Snippet Site Report plugin (version <= 2.0.0105) installed and activated.
• Access to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=rsr_report&last=1).

Exploitation Steps:

1. Identify the vulnerable parameter by analyzing the plugin's AJAX actions or shortcodes.
2. Craft a SQL injection payload to extract data. For example:

   GET /wp-admin/admin-ajax.php?action=rsr_report&last=1 UNION SELECT user_login,user_pass FROM wp_users --
   

3. For CSRF exploitation, create a malicious HTML page that submits a form to the vulnerable endpoint:

   <form action="http://target/wp-admin/admin-ajax.php" method="GET">
     <input type="hidden" name="action" value="rsr_report">
     <input type="hidden" name="last" value="1 UNION SELECT user_login,user_pass FROM wp_users --">
     <input type="submit" value="Click me">
   </form>
   

4. Host the page and trick an authenticated admin into clicking the submit button.

Lab Setup:

• Use a local WordPress installation (e.g., via Docker or XAMPP).
• Install the vulnerable plugin version.
• Use tools like Burp Suite or SQLMap to automate exploitation.

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for suspicious SQL keywords in the last parameter (e.g., UNION, SELECT, --).
• Use a Web Application Firewall (WAF) to block common SQL injection patterns.
• Implement CSRF tokens on all forms and AJAX endpoints.

Defense:

• Immediately disable the plugin if no patch is available.
• Apply virtual patching via WAF rules.
• Restrict access to the vulnerable endpoint using .htaccess or server-level rules.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with action=rsr_report and abnormal last parameter values.
  • SQL error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• File IOCs:
  • Modified plugin files (e.g., rich-snippet-site-report.php) with injected code.
• Database IOCs:
  • Unexpected entries in the wp_reports table or other tables.
  • New user accounts or modified user roles.

Detection Engineering

YARA Rule

rule CVE_2025_10310_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-10310 in Rich Snippet Site Report plugin"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "CVE-2025-10310"
    strings:
        $sqli1 = /last=.*UNION.*SELECT/i
        $sqli2 = /last=.*OR.*1=1/i
        $sqli3 = /last=.*--/i
    condition:
        any of them
}

Sigma Rule

title: SQL Injection Attempt via last Parameter in Rich Snippet Site Report
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting the 'last' parameter in the Rich Snippet Site Report WordPress plugin.
author: Valters IT
date: 2025-03-01
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: 
            - 'last='
        cs-uri-query|re: '(UNION|SELECT|OR|--|%27|%22)'
    condition: selection
falsepositives:
    - Legitimate use of the parameter with numeric values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10310 SQL Injection Attempt"; flow:to_server,established; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=rsr_report"; http_uri; content:"last="; http_uri; pcre:"/last=.*(UNION|SELECT|OR|--)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Apply virtual patching using a WAF (e.g., ModSecurity) to block SQL injection patterns.
3. Review database logs for any signs of data exfiltration.

Long-term Fix:

• The vendor must release a patched version that uses prepared statements and input validation.
• Users should update to the latest version once available.

Workarounds:

• Add the following .htaccess rule to block malicious requests:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (UNION|SELECT|OR|--|%27|%22) [NC]
  RewriteRule ^wp-admin/admin-ajax.php - [F,L]
  

• Implement CSRF tokens for all AJAX endpoints.

Valters IT
Securing Digital Frontiers