SQL Injection in WordPress PICA Photo Gallery Plugin

WordPress Plugin PICA Photo Gallery 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the aid parameter. Attackers can send GET requests with crafted SQL payloads in the aid parameter to extract sensitive database information including user credentials and table contents.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2017-20247 is an unauthenticated SQL injection vulnerability in the PICA Photo Gallery WordPress plugin version 1.0, exploitable through the 'aid' parameter in GET requests. This vulnerability carries a CVSS score of 8.2 (high) and allows attackers to execute arbitrary SQL queries without authentication, potentially exposing sensitive data including user credentials, email addresses, and entire database table contents. WordPress sites running this plugin version are immediately at risk, as the vulnerability requires no special privileges to exploit and can be triggered remotely by anyone with network access to the affected installation.

Casky's 301 matched skills leverage Claude AI with extended reasoning to detect the attack patterns mapped to MITRE ATT&CK tactics TA0001 (Initial Access) and TA0043 (Reconnaissance). Practitioners using Casky would identify SQL injection attempts through detection of anomalous query patterns in web logs—specifically malformed GET requests with SQL syntax characters (UNION, SELECT, OR, comment operators) embedded in the 'aid' parameter. The platform's skills would flag database-focused reconnaissance activity where attackers probe table structures and extract data exfiltration patterns, correlating these behaviors with CWE-89 (SQL Injection) signatures. Security teams would see findings highlighting unauthorized database query execution, suspicious parameter encoding, and data access anomalies that indicate an attacker has successfully achieved code execution at the database layer.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2017-20247.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2017-20247

Casky has 301 skills that investigate the attack patterns behind CVE-2017-20247. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn