CVE-2024-10687: Contest Gallery SQL Injection Vulnerability

CVE-2024-10687 Overview

CVE-2024-10687 is a critical SQL Injection vulnerability affecting the Contest Gallery plugin for WordPress (Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal, Social Share Buttons). The vulnerability exists in all versions up to and including 24.0.3 due to insufficient escaping of the user-supplied $collectedIds parameter and lack of sufficient preparation on the existing SQL query. This time-based SQL Injection flaw allows unauthenticated attackers to append additional SQL queries into already existing queries, enabling extraction of sensitive information from the database.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive database information including user credentials, personal data, and potentially complete database contents without any prior authentication.

Affected Products

• Contest Gallery plugin for WordPress versions up to and including 24.0.3
• WordPress installations using the Contest Gallery plugin (contest-gallery:contest_gallery)
• Sites with ecommerce functionality enabled through the Contest Gallery plugin

Discovery Timeline

• 2024-11-05 - CVE-2024-10687 published to NVD
• 2024-11-08 - Last updated in NVD database

Technical Details for CVE-2024-10687

Vulnerability Analysis

This vulnerability represents a classic time-based SQL Injection attack vector that exploits insufficient input validation in a WordPress plugin. The vulnerable code resides in the ecommerce functionality of the Contest Gallery plugin, specifically within the ecommerce-get-raw-data-from-galleries.php file at line 61. The $collectedIds parameter is passed directly into an SQL query without proper sanitization or parameterized query preparation.

Time-based SQL Injection is particularly dangerous because it allows attackers to infer database information through controlled delays in server responses. By injecting SQL statements that cause conditional time delays (such as SLEEP() functions), attackers can systematically extract data character by character, even when no direct output is visible.

The vulnerability affects the WordPress content management system's database layer, potentially exposing all data stored within the WordPress database including user credentials, posts, configuration settings, and any ecommerce transaction data processed by the plugin.

Root Cause

The root cause of CVE-2024-10687 is a classic CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) issue. The plugin developers failed to implement proper input sanitization and parameterized queries for the $collectedIds parameter. When user-controlled data is directly concatenated into SQL queries without escaping or prepared statements, attackers can inject malicious SQL code that the database engine executes with the same privileges as the application.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can craft malicious HTTP requests containing SQL injection payloads targeting the vulnerable $collectedIds parameter. The attack exploits the ecommerce data retrieval functionality, which is accessible to unauthenticated users browsing gallery content.

The exploitation technique involves sending requests with time-based SQL injection payloads. When the injected SQL condition evaluates to true, the database executes a delay function, and the attacker measures the response time to infer information. By iterating through possible values and observing response timing differences, attackers can systematically extract database contents including sensitive user information, hashed passwords, and configuration data.

For detailed technical analysis of the vulnerable code, refer to the WordPress Plugin File Review and the Wordfence Vulnerability Report.

Detection Methods for CVE-2024-10687

Indicators of Compromise

• Unusual HTTP requests containing SQL syntax patterns targeting gallery or ecommerce endpoints
• Database query logs showing SLEEP(), BENCHMARK(), or WAITFOR DELAY function calls
• Abnormally long response times for specific gallery-related API requests
• Web server logs with URL-encoded SQL injection payloads in query parameters

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in request parameters
• Enable WordPress database query logging and monitor for suspicious time-delay functions
• Implement anomaly detection for response time variations that may indicate blind SQL injection attempts
• Review access logs for repeated requests to ecommerce-related plugin endpoints with varying parameter values

Monitoring Recommendations

• Configure real-time alerting for SQL injection signature matches in WAF logs
• Monitor database connection patterns for unusual query execution times exceeding normal thresholds
• Set up integrity monitoring for WordPress database tables to detect unauthorized data access or modification
• Track failed authentication attempts that may follow successful data extraction from the database

How to Mitigate CVE-2024-10687

Immediate Actions Required

• Update the Contest Gallery plugin to version 24.0.4 or later immediately
• If immediate patching is not possible, temporarily disable the Contest Gallery plugin
• Review database access logs for any signs of prior exploitation
• Consider rotating database credentials and WordPress admin passwords as a precaution
• Implement Web Application Firewall rules to block SQL injection attempts at the network edge

Patch Information

The vendor has released a security patch in version 24.0.4 that addresses this SQL Injection vulnerability. The fix implements proper input sanitization and prepared statements for the $collectedIds parameter. Site administrators should update via the WordPress plugin update mechanism or download the patched version directly from the WordPress plugin repository.

Review the complete changeset at the WordPress Plugin Change Log.

Workarounds

• Disable the Contest Gallery plugin entirely until patching is possible
• Implement server-level input filtering to block common SQL injection patterns
• Restrict access to the WordPress admin panel and plugin endpoints using IP whitelisting
• Deploy a WAF with SQL injection protection rules enabled for the affected site

# Example: Block common SQL injection patterns at the web server level (Apache)
# Add to .htaccess in the WordPress root directory
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (;|'|"|%27|%22|--) [NC]
    RewriteRule .* - [F,L]
</IfModule>