CVE-2015-7670 – This CVE describes SQL injection vulnerabilitie... (How to Fix)

📋 TL;DR

This CVE describes SQL injection vulnerabilities in the Support Ticket System WordPress plugin before version 1.2.1. Remote attackers can execute arbitrary SQL commands via user or id parameters, potentially compromising the WordPress database. WordPress sites using vulnerable versions of this plugin are affected.

💻 Affected Systems

Products:

Support Ticket System WordPress plugin

Versions: All versions before 1.2.1

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires WordPress installation with the vulnerable plugin activated.

📦 What is this software?

Support Ticket System by Support Ticket System Project

View all CVEs affecting Support Ticket System →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise leading to data theft, privilege escalation, and full site takeover via arbitrary SQL execution.

🟠

Likely Case

Database information disclosure, modification of ticket data, and potential administrative access to WordPress.

🟢

If Mitigated

Limited impact with proper input validation and database permissions, potentially only affecting the plugin's data tables.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

SQL injection via URL parameters makes exploitation straightforward for attackers.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.2.1

Vendor Advisory: https://wordpress.org/plugins/simple-support-ticket-system/#developers

Restart Required: No

Instructions:

1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Support Ticket System' plugin
4. Click 'Update Now' if available
5. If no update available, download version 1.2.1+ from WordPress.org
6. Deactivate old plugin, upload new version, activate

🔧 Temporary Workarounds

Disable vulnerable plugin

all

Temporarily deactivate the Support Ticket System plugin until patched

wp plugin deactivate simple-support-ticket-system

Web Application Firewall rule

linux

Block SQL injection attempts targeting update.php parameters

ModSecurity rule: SecRule ARGS_GET "@detectSQLi" "id:1001,phase:2,deny,status:403"

🧯 If You Can't Patch

Remove the plugin entirely if ticket functionality is not critical
Implement strict input validation and parameterized queries in the plugin code

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Support Ticket System version. If version < 1.2.1, vulnerable.

Check Version:

wp plugin get simple-support-ticket-system --field=version

Verify Fix Applied:

Confirm plugin version is 1.2.1 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual SQL errors in WordPress logs
Multiple requests to /wp-content/plugins/simple-support-ticket-system/includes/update.php with SQL-like parameters

Network Indicators:

HTTP requests containing SQL injection patterns in user or id parameters to the update.php endpoint

SIEM Query:

source="wordpress.log" AND "update.php" AND ("user=" OR "id=") AND ("UNION" OR "SELECT" OR "INSERT" OR "DELETE")

📊 Metadata

CVE ID: CVE-2015-7670

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: September 26, 2017

Last Updated: April 20, 2025

🔗 References

http://www.securityfocus.com/archive/1/536624/100/0/threaded
https://wordpress.org/plugins/simple-support-ticket-system/#developers Release Notes,Third Party Advisory
https://wpvulndb.com/vulnerabilities/8207 Third Party Advisory
http://www.securityfocus.com/archive/1/536624/100/0/threaded
https://wordpress.org/plugins/simple-support-ticket-system/#developers Release Notes,Third Party Advisory
https://wpvulndb.com/vulnerabilities/8207 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2015-7670, you might also want to check these: