CVE-2024-13500

Executive Summary

CVE-2024-13500 is a time-based SQL Injection vulnerability discovered in the WP Project Manager plugin for WordPress, affecting all versions up to and including 2.6.17. The flaw resides in the orderby parameter, which is insufficiently sanitized before being used in SQL queries. An authenticated attacker with Subscriber-level access or higher can exploit this to extract sensitive information from the WordPress database, such as user credentials, password hashes, and other private data. The vulnerability is classified as a WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx). The EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis, but the lack of a patch makes it a persistent risk.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel for a patched version. Since the plugin is not an NPM, PyPI, Go, or Ruby package, no additional supply chain analysis is required.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is elevated due to the low privileges required and the potential for full database compromise, despite the medium CVSS score.

Deep Dive & Mechanics

The vulnerability is a classic time-based SQL injection in the orderby parameter of the WP Project Manager plugin. The plugin fails to properly escape the user-supplied orderby value and does not use prepared statements for the SQL query. This allows an attacker to inject arbitrary SQL commands that are executed in the context of the WordPress database.

Technical Flow:

1. The plugin receives a request with an orderby parameter (e.g., via AJAX or REST API).
2. The parameter is directly concatenated into an SQL query without sanitization.
3. An attacker can inject a SLEEP() function to cause a time delay, confirming the injection point.
4. Using blind SQL injection techniques, the attacker can extract data character by character.

Example vulnerable SQL query (pseudo-code):

SELECT * FROM wp_pm_tasks ORDER BY {user_input} ASC

Injection example:

orderby=id,SLEEP(5)--

This would cause a 5-second delay if the injection is successful.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.6.17):

// In a controller or model file
$orderby = $_GET['orderby'];
$query = "SELECT * FROM {$wpdb->prefix}pm_tasks ORDER BY $orderby ASC";
$results = $wpdb->get_results($query);

Patched Code (hypothetical fix):

// Use whitelist or prepared statement
$allowed_orderby = ['id', 'title', 'due_date'];
$orderby = in_array($_GET['orderby'], $allowed_orderby) ? $_GET['orderby'] : 'id';
$query = $wpdb->prepare("SELECT * FROM {$wpdb->prefix}pm_tasks ORDER BY %s ASC", $orderby);
$results = $wpdb->get_results($query);

The patched version would either whitelist allowed values or use a prepared statement with proper escaping.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with WP Project Manager plugin <= 2.6.17
• Valid subscriber-level account (or higher)
• Knowledge of the target database table structure

Exploitation Steps:

1. Authenticate to WordPress and obtain a nonce or session cookie.
2. Send a crafted request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=pm_task_list&orderby=id,SLEEP(5)--).
3. Observe the response time. If a 5-second delay occurs, the injection is confirmed.
4. Use a tool like sqlmap to automate data extraction:

   sqlmap -u "http://target.com/wp-admin/admin-ajax.php?action=pm_task_list&orderby=id" --cookie="wordpress_logged_in=..." --data="action=pm_task_list&orderby=id" --technique=T --time-sec=5 --batch
   

Manual Payload Example:

orderby=id AND (SELECT 1 FROM (SELECT SLEEP(5))a)--

Blue Team (Detection & Response)

Detection Steps:

• Monitor for unusual orderby parameter values containing SQL keywords (e.g., SLEEP, BENCHMARK, UNION).
• Look for time-based anomalies in HTTP response times (e.g., consistent 5-second delays).
• Check database logs for slow queries or unexpected SLEEP() calls.

Response:

• Immediately block the attacking IP address.
• Review database access logs for any extracted data.
• Apply virtual patching via WAF rules (see Detection Engineering).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with orderby parameter containing SLEEP(), BENCHMARK(), or UNION SELECT.
  • Unusual response times (e.g., 5+ seconds) for specific endpoints.
• Host IOCs:
  • Database logs showing SLEEP() function calls.
  • WordPress debug logs with SQL errors containing injected strings.
• File IOCs:
  • Modified plugin files (if attacker uploaded a webshell).
  • Suspicious entries in wp_options or wp_usermeta tables.

Detection Engineering

YARA Rule

rule CVE_2024_13500_SQLi_OrderBy {
    meta:
        description = "Detects SQL injection attempts targeting WP Project Manager orderby parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13500"
    strings:
        $sleeper = /orderby=.*SLEEP\s*\(/ nocase
        $benchmark = /orderby=.*BENCHMARK\s*\(/ nocase
        $union = /orderby=.*UNION\s+SELECT/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-13500 SQL Injection via orderby Parameter
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects time-based SQL injection attempts against WP Project Manager plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - 'orderby=*SLEEP('
            - 'orderby=*BENCHMARK('
            - 'orderby=*UNION SELECT'
    condition: selection
falsepositives:
    - Legitimate use of 'orderby' with similar patterns (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13500 WP Project Manager SQL Injection"; flow:to_server,established; content:"orderby"; http_uri; nocase; pcre:"/orderby=.*(SLEEP|BENCHMARK|UNION\s+SELECT)/iU"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical for operations.
2. Apply virtual patching using a WAF (e.g., ModSecurity, Cloudflare) to block malicious orderby patterns.
3. Restrict user roles – ensure only trusted users have Subscriber-level access.

Long-term Fix:

• The vendor must release a patched version that uses prepared statements or whitelists the orderby parameter.
• Until then, consider forking the plugin and applying the fix manually.

Workaround:

• Add a custom filter in WordPress to sanitize the orderby parameter:

  add_filter('pm_orderby_param', function($orderby) {
      $allowed = ['id', 'title', 'due_date'];
      return in_array($orderby, $allowed) ? $orderby : 'id';
  });
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst