CVE-2025-30765

Executive Summary

CVE-2025-30765 is a critical Blind SQL Injection vulnerability discovered in the WordPress plugin FlexStock (stock-sync-with-google-sheet-for-woocommerce) by WPPOOL. The flaw resides in improper neutralization of special elements used in an SQL command, allowing unauthenticated attackers to perform blind SQL injection attacks. This can lead to unauthorized data extraction from the WordPress database, including user credentials, session tokens, and sensitive WooCommerce data. The vulnerability affects all versions up to and including 3.13.1. No public proof-of-concept (PoC) or patch is currently available, but the risk is elevated due to the plugin's widespread use in e-commerce environments.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. FlexStock is distributed via the official WordPress plugin repository and third-party marketplaces. Since no patch exists, users are advised to treat the plugin as compromised and consider disabling it until a fix is released. The lack of a patch increases the risk of supply chain attacks where threat actors could inject malicious SQL queries to exfiltrate data or modify WooCommerce stock data.

CVSS Breakdown & Threat Level

• CVSS Score: 7.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

The high confidentiality impact reflects the ability to extract sensitive database contents, while low integrity and availability impacts indicate limited ability to modify or disrupt data. The threat level is High due to the ease of exploitation and potential for data breaches.

Deep Dive & Mechanics

The vulnerability exists in the FlexStock plugin's handling of user-supplied input within SQL queries. Specifically, the plugin fails to sanitize or parameterize input passed to database operations, allowing an attacker to inject arbitrary SQL commands. Because the application does not return database errors or results directly, the attack is blind—the attacker must infer information based on response timing or boolean responses.

Attack Vector: The injection likely occurs through HTTP GET or POST parameters used in stock synchronization or Google Sheet integration features. For example, a parameter like sheet_id or product_sku may be concatenated directly into an SQL query without proper escaping.

Blind SQL Injection Technique: The attacker can use time-based payloads (e.g., SLEEP(5)) or boolean-based queries (e.g., AND 1=1 vs AND 1=2) to extract data character by character. Common tools like sqlmap can automate this process.

Impact: Successful exploitation allows an attacker to:

• Dump the WordPress user table (usernames, password hashes, email addresses).
• Extract WooCommerce customer data (names, addresses, order details).
• Retrieve session tokens for privilege escalation.
• Potentially modify stock levels or product data.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is typical of SQL injection in WordPress plugins:

Vulnerable Code (PHP):

$sheet_id = $_GET['sheet_id'];
$query = "SELECT * FROM wp_flexstock_data WHERE sheet_id = '$sheet_id'";
$result = $wpdb->get_results($query);

Patched Code (Expected):

$sheet_id = intval($_GET['sheet_id']); // or use $wpdb->prepare
$query = $wpdb->prepare("SELECT * FROM wp_flexstock_data WHERE sheet_id = %d", $sheet_id);
$result = $wpdb->get_results($query);

The patched version uses $wpdb->prepare() with placeholders to ensure input is properly escaped and parameterized, preventing injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with FlexStock <= 3.13.1 installed and activated.
• A target parameter vulnerable to injection (e.g., sheet_id in the stock sync endpoint).

Manual Exploitation:

1. Identify the vulnerable parameter by sending requests and observing response times.
2. Use time-based payloads to confirm injection:

   sheet_id=1' AND SLEEP(5)--
   

3. Extract data using boolean-based queries:

   sheet_id=1' AND (SELECT SUBSTRING(user_pass,1,1) FROM wp_users WHERE ID=1)='a'--
   

Automated Exploitation with sqlmap:

sqlmap -u "http://target.com/wp-admin/admin-ajax.php?action=flexstock_sync&sheet_id=1" --batch --dbs

Note: No public exploit code is available; the above is a generic approach.

Blue Team

Detection:

• Monitor for SQL injection patterns in web logs (e.g., SLEEP, BENCHMARK, UNION).
• Look for abnormal response times (e.g., >5 seconds) from the FlexStock endpoint.
• Use WAF rules to block common SQL injection payloads.

Hunting:

• Search for requests to admin-ajax.php with action=flexstock_sync and suspicious parameters.
• Analyze database query logs for unexpected SELECT statements on wp_users or wp_options.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing SLEEP(, BENCHMARK(, or UNION SELECT in parameters.
  • Repeated requests to /wp-admin/admin-ajax.php?action=flexstock_sync with varying sheet_id values.
• File IOCs:
  • Modified plugin files (e.g., flexstock/includes/class-flexstock-sync.php) containing injected code.
• Database IOCs:
  • Unusual entries in wp_options or wp_usermeta tables.
  • New admin users created via SQL injection.

Detection Engineering

YARA Rule

rule CVE_2025_30765_FlexStock_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting FlexStock plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-30765"
    strings:
        $sqli1 = /sheet_id=[^&]*['\"]\s*(OR|AND|UNION|SELECT|SLEEP|BENCHMARK)/i
        $sqli2 = /action=flexstock_sync.*sheet_id=[^&]*['\"]/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-30765 FlexStock SQL Injection Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection patterns in FlexStock plugin requests
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'sheet_id='
            - 'action=flexstock_sync'
        cs-uri-query|re: '(SLEEP|BENCHMARK|UNION|SELECT|OR 1=1|AND 1=2)'
    condition: selection
falsepositives:
    - Legitimate use of special characters in sheet IDs (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-30765 FlexStock SQL Injection Attempt"; flow:to_server; content:"/admin-ajax.php"; http_uri; content:"action=flexstock_sync"; http_uri; pcre:"/sheet_id=[^&]*['\"]\s*(OR|AND|UNION|SELECT|SLEEP|BENCHMARK)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the FlexStock plugin until an official patch is released.
2. Implement a Web Application Firewall (WAF) with rules to block SQL injection payloads.
3. Restrict access to the vulnerable endpoint via .htaccess or server configuration:

   <Files "admin-ajax.php">
       Require ip 127.0.0.1
   </Files>
   

Long-term Fix:

• Monitor the WPPOOL vendor for a patched version (>= 3.13.2).
• Apply the principle of least privilege to the database user used by WordPress.
• Conduct a security audit of all WordPress plugins.

Workaround:

• If the plugin is critical, manually patch the vulnerable code by replacing direct SQL queries with $wpdb->prepare() calls.

Valters IT
Securing Digital Frontiers