CVE-2020-11530 – CVE-2020-11530 is a critical SQL injection vuln... (How to Fix)

Q: What is the severity of CVE-2020-11530?

CVE-2020-11530 has a CVSS score of 9.8 (CRITICAL). CVE-2020-11530 is a critical SQL injection vulnerability in the Chop Slider 3 WordPress plugin that allows attackers to execute arbitrary SQL queries through the id parameter in get_script/index.php. This affects all WordPress sites running vulnerable versions of the plugin, potentially compromising the entire database.

📋 TL;DR

CVE-2020-11530 is a critical SQL injection vulnerability in the Chop Slider 3 WordPress plugin that allows attackers to execute arbitrary SQL queries through the id parameter in get_script/index.php. This affects all WordPress sites running vulnerable versions of the plugin, potentially compromising the entire database.

💻 Affected Systems

Products:

WordPress Chop Slider 3 Plugin

Versions: Versions up to and including 3.4

Operating Systems: All

Default Config Vulnerable: ⚠️ Yes

Notes: Affects all WordPress installations using vulnerable plugin versions regardless of configuration.

📦 What is this software?

Chop Slider by Idangero

View all CVEs affecting Chop Slider →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete database compromise including sensitive data exfiltration, privilege escalation, and full site takeover.

🟠

Likely Case

Data theft, user information leakage, and potential administrative access to the WordPress site.

🟢

If Mitigated

Limited impact with proper input validation and database user restrictions.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Multiple public exploit scripts available; requires no authentication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Version after 3.4

Vendor Advisory: https://idangero.us/

Restart Required: No

Instructions:

1. Update Chop Slider 3 plugin to latest version. 2. If update unavailable, remove plugin entirely. 3. Verify no vulnerable files remain.

🔧 Temporary Workarounds

Block vulnerable endpoint

all

Block access to get_script/index.php via web server configuration

# Apache: RewriteRule ^wp-content/plugins/chop-slider-3/get_script/index\.php - [F,L]
# Nginx: location ~* /wp-content/plugins/chop-slider-3/get_script/index\.php { deny all; }

Input validation via WAF

all

Implement web application firewall rules to block SQL injection patterns

🧯 If You Can't Patch

Immediately disable or remove the Chop Slider 3 plugin
Implement strict network segmentation and monitor for SQL injection attempts

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel for Chop Slider 3 plugin version ≤3.4

Check Version:

wp plugin list | grep -i chop

Verify Fix Applied:

Confirm plugin version >3.4 or plugin completely removed

📡 Detection & Monitoring

Log Indicators:

Unusual SQL queries in database logs
Multiple requests to /wp-content/plugins/chop-slider-3/get_script/index.php with SQL patterns

Network Indicators:

HTTP requests with SQL injection payloads in id parameter
Unusual database connections from web server

SIEM Query:

source="web_logs" AND uri="/wp-content/plugins/chop-slider-3/get_script/index.php" AND (query_string="*id=*" AND (query_string="*UNION*" OR query_string="*SELECT*" OR query_string="*OR*"))

📊 Metadata

CVE ID: CVE-2020-11530

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-89

Published: May 8, 2020

Last Updated: November 21, 2024

🔗 References

http://packetstormsecurity.com/files/157607/WordPress-ChopSlider-3-SQL-Injection.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/157655/WordPress-ChopSlider3-3.4-SQL-Injection.html Exploit,Third Party Advisory
http://seclists.org/fulldisclosure/2020/May/26 Mailing List,Third Party Advisory
https://github.com/idangerous/Plugins/tree/master/Chop%20Slider%203 Third Party Advisory
https://idangero.us/ Product
http://packetstormsecurity.com/files/157607/WordPress-ChopSlider-3-SQL-Injection.html Exploit,Third Party Advisory,VDB Entry
http://packetstormsecurity.com/files/157655/WordPress-ChopSlider3-3.4-SQL-Injection.html Exploit,Third Party Advisory
http://seclists.org/fulldisclosure/2020/May/26 Mailing List,Third Party Advisory
https://github.com/idangerous/Plugins/tree/master/Chop%20Slider%203 Third Party Advisory
https://idangero.us/ Product

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2020-11530, you might also want to check these: