CVE-2021-24140: Ajax Load More SQL Injection Vulnerability

CVE-2021-24140 Overview

CVE-2021-24140 is a SQL Injection vulnerability affecting the Ajax Load More WordPress plugin in versions prior to 5.3.2. The vulnerability exists due to unvalidated input handling in the plugin's AJAX request processing. Attackers can exploit this flaw by sending specially crafted POST requests to /wp-admin/admin-ajax.php with malicious SQL payloads injected through the repeater parameter.

Critical Impact

Authenticated attackers with high privileges can execute arbitrary SQL commands against the WordPress database, potentially leading to complete database compromise, data exfiltration, data modification, or deletion of critical site content.

Affected Products

• Ajax Load More WordPress plugin versions prior to 5.3.2
• Connekthq Ajax Load More

Discovery Timeline

• 2021-03-18 - CVE-2021-24140 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-24140

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection), a critical web application security flaw that occurs when user-supplied input is not properly validated or sanitized before being incorporated into SQL queries. In this case, the Ajax Load More plugin fails to properly sanitize the repeater and type parameters in POST requests sent to the WordPress AJAX handler.

The vulnerability requires network access and authenticated access with high privileges to exploit, though successful exploitation results in significant impact to confidentiality, integrity, and availability of the underlying WordPress database.

Root Cause

The root cause of this vulnerability lies in improper input validation within the Ajax Load More plugin's AJAX request handling mechanism. User-controlled input from the repeater parameter is directly concatenated into SQL queries without proper sanitization, parameterized queries, or prepared statements. This allows attackers to inject arbitrary SQL syntax that modifies the intended query logic.

Attack Vector

The attack is executed over the network by sending specially crafted POST requests to the WordPress AJAX endpoint. An authenticated attacker with high privileges submits a POST request to /wp-admin/admin-ajax.php containing malicious SQL payload in the repeater parameter. The example payload repeater=' or sleep(5)#&type=test demonstrates a time-based blind SQL injection technique where the sleep(5) function introduces a measurable delay, confirming successful injection.

Once injection is confirmed, attackers can escalate to more sophisticated payloads to:

• Extract sensitive data using UNION-based or error-based techniques
• Modify or delete database records
• Potentially achieve remote code execution through SQL features like INTO OUTFILE
• Access WordPress user credentials and session tokens

Detection Methods for CVE-2021-24140

Indicators of Compromise

• Unusual or malformed POST requests to /wp-admin/admin-ajax.php containing SQL syntax in the repeater parameter
• Web server access logs showing suspicious characters such as single quotes, SQL keywords (UNION, SELECT, SLEEP, OR), or comment markers (#, --)
• Database performance anomalies indicating time-based injection attempts (e.g., delayed responses)
• Unexpected database queries or errors in WordPress debug logs

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in POST parameters
• Monitor WordPress AJAX endpoint logs for suspicious activity targeting the repeater parameter
• Deploy intrusion detection signatures for common SQL injection payloads
• Enable WordPress database query logging to identify anomalous SQL statements

Monitoring Recommendations

• Configure alerting on access logs for requests to /wp-admin/admin-ajax.php containing SQL metacharacters
• Monitor plugin version inventory to ensure Ajax Load More is updated to 5.3.2 or later
• Implement database activity monitoring to detect unauthorized data access or modifications
• Review WordPress audit logs for unusual administrative actions following potential exploitation

How to Mitigate CVE-2021-24140

Immediate Actions Required

• Update the Ajax Load More plugin to version 5.3.2 or later immediately
• Review database access logs for signs of prior exploitation
• Temporarily disable the Ajax Load More plugin if immediate patching is not possible
• Audit WordPress user accounts with high privileges that could have been compromised

Patch Information

The vulnerability has been addressed in Ajax Load More version 5.3.2. Organizations should update to this version or later through the WordPress plugin dashboard. Additional details are available through the WPScan Vulnerability Advisory.

Workarounds

• Restrict access to /wp-admin/admin-ajax.php at the web server level for untrusted networks
• Implement a Web Application Firewall (WAF) with SQL injection protection rules
• Limit the number of WordPress administrator accounts and enforce strong authentication
• Consider network segmentation to isolate the WordPress database server

# Example: Block suspicious requests to admin-ajax.php using .htaccess
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (union|select|insert|drop|delete|sleep|benchmark) [NC,OR]
    RewriteCond %{REQUEST_BODY} (union|select|insert|drop|delete|sleep|benchmark) [NC]
    RewriteRule ^wp-admin/admin-ajax\.php$ - [F,L]
</IfModule>