Unauthenticated SQL Injection in Micahblu Rsvp Me WordPress Plugin (CVE-2024-50491)

The Micahblu Rsvp Me WordPress plugin is vulnerable to an unauthenticated SQL injection flaw, identified as CVE-2024-50491. The vulnerability exists in all versions up to and including 1.9.9. It stems from insufficient sanitization of the 'id' parameter when processed by the 'rsvp_me_event_data' action within the plugin. Because the input is not correctly handled or prepared, an attacker can inject malicious SQL commands into existing queries. This vulnerability allows unauthenticated remote actors to gain unauthorized access to the underlying MySQL database, facilitating the extraction of sensitive information. A public proof-of-concept exploit exists, which significantly lowers the barrier for exploitation by unauthorized parties.

Attack Chain

1. Attacker identifies an internet-facing WordPress instance running the vulnerable Micahblu Rsvp Me plugin.
2. Attacker crafts an HTTP POST request targeting the /wp-admin/admin-ajax.php endpoint.
3. Attacker sets the 'action' parameter to 'rsvp_me_event_data'.
4. Attacker inserts malicious SQL payloads into the 'id' parameter, such as boolean-based or time-based blind injection queries.
5. The plugin fails to sanitize the input, passing the malicious payload directly to the back-end MySQL database.
6. The database executes the injected query, returning sensitive results or confirming the success of the blind injection.
7. Attacker iterates through the injection points to extract data from the database.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to read data from the WordPress database, potentially leading to the compromise of sensitive user information, administrative credentials, or configuration details. Given the high CVSS score, organizations using this plugin are at high risk of data exfiltration.

Recommendation

1. Upgrade the Micahblu Rsvp Me plugin to a version beyond 1.9.9 immediately or disable the plugin if no patch is available.
2. Deploy WAF rules to monitor or block HTTP requests to /wp-admin/admin-ajax.php containing SQL-related characters (e.g., 'SELECT', 'SLEEP', 'UNION', '--') in the 'id' parameter when 'action=rsvp_me_event_data'.
3. Review web access logs for anomalous POST requests to the admin-ajax.php endpoint that include SQL syntax patterns.