Critical SQL Injection in Quiz Maker WordPress Plugin

CVE-2024-6028 is a high-severity time-based SQL injection vulnerability affecting the Ays-pro Quiz Maker WordPress plugin, versions 6.5.8.3 and lower. The vulnerability resides within the 'ays_questions' parameter processed by the 'ays_finish_quiz' action in the 'Quiz_Maker_Public' class. An unauthenticated attacker can exploit this flaw by sending a specially crafted HTTP POST request to the WordPress 'admin-ajax.php' endpoint. Due to the lack of sufficient input sanitization and parameter escaping, the attacker can inject malicious SQL commands that the application executes against the underlying WordPress database. Successful exploitation allows an attacker to infer sensitive information through time-based inferencing (e.g., using the MySQL SLEEP function). The vulnerability has a CVSS 9.8 rating, and a publicly available proof-of-concept exploit increases the risk of immediate exploitation by malicious actors.

Impact

Successful exploitation of this vulnerability allows unauthenticated attackers to gain unauthorized access to the application database. This can result in the full compromise of sensitive data stored within the WordPress environment, including user accounts, site configurations, and potentially other plugins' data. Given the widespread use of WordPress plugins, this vulnerability presents a significant risk to the confidentiality and integrity of affected sites.

Recommendation

Prioritized, concrete actions for detection engineering teams:

• Update the Ays-pro Quiz Maker plugin to version 6.5.8.4 or later immediately.
• Deploy the provided Sigma rule to monitor for suspicious POST requests targeting 'admin-ajax.php' containing SQL injection syntax in the 'ays_questions' parameter.
• Review web server access logs for anomalous spikes in response times coupled with POST requests to 'admin-ajax.php', which may indicate active time-based SQL injection attempts.