CVE-2017-1002020
📋 TL;DR
This SQL injection vulnerability in the WordPress Surveys plugin allows attackers to execute arbitrary SQL commands through the unsanitized 'action' parameter in survey_form.php. Any WordPress site running the vulnerable plugin version is affected, potentially leading to complete database compromise.
💻 Affected Systems
- WordPress Surveys plugin
📦 What is this software?
Surveys by Surveys Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including user credentials, sensitive survey data, and potential privilege escalation to WordPress admin.
Likely Case
Data exfiltration from surveys database tables, potential insertion of malicious content, or site defacement.
If Mitigated
Limited impact if database user has minimal privileges and input validation is enforced elsewhere.
🎯 Exploit Status
SQL injection via GET/POST parameter requires minimal technical skill to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.01.9 or later
Vendor Advisory: https://wordpress.org/plugins/surveys/
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Surveys' plugin
4. Click 'Update Now' if available
5. If no update available, deactivate and delete plugin
🔧 Temporary Workarounds
Input Validation Filter
allAdd input validation for the 'action' parameter before plugin code executes
Add to theme's functions.php or custom plugin:
add_filter('pre_survey_action', function($action) {
return preg_replace('/[^a-zA-Z0-9_]/', '', $action);
});
🧯 If You Can't Patch
- Deactivate the Surveys plugin immediately
- Implement web application firewall (WAF) rules to block SQL injection patterns targeting the 'action' parameter
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Surveys plugin version. If version is 1.01.8 or earlier, site is vulnerable.Check Version:
wp plugin list --name=surveys --field=versionVerify Fix Applied:
Verify plugin version is 1.01.9 or later in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple requests to survey_form.php with suspicious 'action' parameters
- Error logs showing SQL syntax errors
Network Indicators:
- HTTP requests to /wp-content/plugins/surveys/survey_form.php with SQL keywords in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_access_logs" AND uri="*survey_form.php*" AND (param="*action=*SELECT*" OR param="*action=*UNION*" OR param="*action=*INSERT*")