CVE-2025-32303

Executive Summary

CVE-2025-32303 is a critical Blind SQL Injection vulnerability in the WordPress plugin WPCHURCH (church-management) by Mojoomla, affecting versions through 2.7.0. The vulnerability allows unauthenticated attackers to execute arbitrary SQL commands via improper neutralization of special elements. With a CVSS score of 9.3, this flaw can lead to complete compromise of the WordPress database, including user credentials, posts, and configuration data. No public proof-of-concept or patch is currently available, making this a high-priority zero-day for WordPress site administrators.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users should verify plugin integrity via checksums and monitor for updates. No known supply chain compromise has been reported, but the unpatched status increases risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – Full database read access.
• Integrity (I): High (H) – Ability to modify database content.
• Availability (A): High (H) – Potential to delete or corrupt data.

Threat Level: Critical. Unauthenticated remote SQL injection with no patch available.

Deep Dive & Mechanics

The vulnerability resides in the WPCHURCH plugin's handling of user-supplied input within SQL queries. The plugin fails to properly sanitize or parameterize special characters (e.g., single quotes, double dashes) in parameters passed to database queries. This allows an attacker to inject arbitrary SQL commands, which are then executed by the WordPress database.

Blind SQL Injection means the attacker does not see direct error output but can infer information based on application responses (e.g., timing delays, boolean responses). This can be exploited to extract data character by character.

Attack Vector: The injection likely occurs through HTTP GET or POST parameters used in church management features (e.g., event IDs, member search, or calendar parameters). The exact parameter is not publicly disclosed, but common WordPress plugin injection points include id, cat, page, or custom query variables.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is typical of unsanitized SQL queries:

Vulnerable Code (PHP):

$event_id = $_GET['event_id'];
$query = "SELECT * FROM wp_events WHERE id = $event_id";
$result = $wpdb->get_results($query);

Patched Code (Hypothetical):

$event_id = intval($_GET['event_id']);
$query = $wpdb->prepare("SELECT * FROM wp_events WHERE id = %d", $event_id);
$result = $wpdb->get_results($query);

The patched version uses intval() for integer casting and $wpdb->prepare() for parameterized queries, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• WordPress 6.x with WPCHURCH 2.7.0 installed.
• Kali Linux with sqlmap and Burp Suite.
• Local or cloud-hosted vulnerable instance.

Exploitation Steps:

1. Identify injection point (e.g., ?event_id=1).
2. Test for injection with ' or 1=1--.
3. Use sqlmap for automated blind injection:

sqlmap -u "http://target/wp-admin/admin-ajax.php?action=wpchurch_get_event&event_id=1" --batch --dbs

4. Extract data:

sqlmap -u "http://target/wp-admin/admin-ajax.php?action=wpchurch_get_event&event_id=1" -D wordpress --tables

Manual Blind Injection (Time-based):

1 AND IF(SUBSTRING((SELECT user_pass FROM wp_users LIMIT 1),1,1)='a',SLEEP(5),0)--

Blue Team (Defensive)

Detection:

• Monitor for SQL error messages in logs (e.g., You have an error in your SQL syntax).
• Look for abnormal HTTP requests with SQL keywords (UNION, SELECT, SLEEP).
• Use WAF rules to block common SQL injection patterns.

Hunting:

• Search for requests to wpchurch endpoints with suspicious parameters.
• Analyze database query logs for unexpected SLEEP() or BENCHMARK() calls.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing SQL keywords in parameters (e.g., event_id=1 UNION SELECT).
• Logs: MySQL error logs showing syntax errors from plugin queries.
• Database: Unexpected rows in wp_options or wp_users tables.
• File System: Modified plugin files (check file integrity via WordPress checksums).

Example IOC (Suricata rule trigger):

alert http any any -> any any (msg:"SQL Injection - WPCHURCH Blind"; content:"wpchurch"; content:"SELECT"; within:100; sid:1000001;)

Detection Engineering

YARA Rule

rule CVE_2025_32303_WPCHURCH_SQLi {
    meta:
        description = "Detects SQL injection attempts against WPCHURCH plugin"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2025-32303"
    strings:
        $s1 = "wpchurch" nocase
        $s2 = "SELECT" nocase
        $s3 = "UNION" nocase
        $s4 = "SLEEP" nocase
        $s5 = "BENCHMARK" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against WPCHURCH Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting WPCHURCH WordPress plugin
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 'wpchurch'
        c-uri|contains|any:
            - 'SELECT'
            - 'UNION'
            - 'SLEEP'
            - 'BENCHMARK'
    condition: selection
falsepositives:
    - Legitimate use of SQL keywords in URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32303 WPCHURCH Blind SQL Injection Attempt"; flow:to_server; content:"wpchurch"; http_uri; content:"SELECT"; http_uri; within:100; classtype:web-application-attack; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) with SQL injection rules.
3. Restrict access to wp-admin and plugin endpoints via IP whitelisting.

Long-term Fix:

• Monitor the Mojoomla website for a patched version (>= 2.7.1).
• Apply the patch immediately when available.
• Consider replacing the plugin with an alternative if no patch is released.

Workaround:

• Add custom code to sanitize input in the plugin's functions (if you have developer access):

add_filter('query_vars', function($vars) {
    $vars[] = 'event_id';
    return $vars;
});
add_action('pre_get_posts', function($query) {
    if ($query->get('event_id')) {
        $query->set('event_id', intval($query->get('event_id')));
    }
});

Valters IT
Securing Digital Frontiers