CVE-2024-13507

Executive Summary

CVE-2024-13507 is a critical unauthenticated time-based SQL Injection vulnerability discovered in the GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress. The flaw resides in the handling of the dist parameter, which is used in SQL queries without proper escaping or parameterization. This allows an unauthenticated attacker to inject arbitrary SQL commands, potentially extracting sensitive data from the WordPress database, including user credentials, session tokens, and other confidential information. The vulnerability affects all versions up to and including 2.8.97. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. GeoDirectory is a commercial plugin distributed via the WordPress plugin repository and its own website. Users are advised to monitor the vendor’s update channel for a patched version. Since the plugin is not distributed via NPM, PyPI, Go, or Ruby, no additional package security concerns apply.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is rated High due to the ease of exploitation (no authentication required) and the potential for complete database compromise. The time-based nature of the SQL injection makes it stealthy but still exploitable.

Deep Dive & Mechanics

The vulnerability exists in the SQL query construction for the dist parameter. The plugin fails to properly escape or parameterize user-supplied input before incorporating it into a SQL query. Specifically, the dist parameter is used in a ORDER BY or WHERE clause without adequate sanitization. An attacker can inject a time-based SQL payload (e.g., SLEEP(5)) to infer database information bit by bit.

The injection point is likely in a function that builds a query for listing results based on distance or location. The lack of prepared statements allows the attacker to break out of the intended SQL syntax and append malicious clauses.

Example vulnerable code pattern (conceptual):

$dist = $_GET['dist'];
$query = "SELECT * FROM wp_posts WHERE ... ORDER BY dist = '$dist'";

Exploitation technique:

• The attacker sends a request with a crafted dist parameter containing a time-based SQL injection payload.
• The server’s response time indicates whether the injected condition is true or false.
• By iterating through characters, the attacker can extract the entire database schema and contents.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on best practices.

Vulnerable code (conceptual):

$dist = $_GET['dist'];
$query = "SELECT * FROM wp_posts WHERE ... ORDER BY dist = '$dist'";
$result = $wpdb->get_results($query);

Patched code (conceptual):

$dist = intval($_GET['dist']); // or use $wpdb->prepare
$query = $wpdb->prepare(
    "SELECT * FROM wp_posts WHERE ... ORDER BY dist = %d",
    $dist
);
$result = $wpdb->get_results($query);

The patched version uses $wpdb->prepare() to ensure the dist parameter is treated as a literal value, preventing SQL injection.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with GeoDirectory plugin version <= 2.8.97.
• Knowledge of the target’s base URL.

Exploitation Steps:

1. Identify a page that uses the dist parameter (e.g., search results or directory listings).
2. Inject a time-based payload to confirm vulnerability:

   GET /?dist=1' AND SLEEP(5)-- -
   

   If the response is delayed by 5 seconds, the vulnerability is confirmed.
3. Use a tool like sqlmap to automate data extraction:

   sqlmap -u "http://target.com/?dist=1" --batch --time-sec=5 --dbs
   

4. Extract user credentials from the wp_users table:

   sqlmap -u "http://target.com/?dist=1" --batch -D wordpress -T wp_users --dump
   

Note: No public exploit code is available; the above is a generic approach.

Blue Team (Defensive)

Detection:

• Monitor for abnormal response times in HTTP requests containing the dist parameter.
• Look for SQL keywords (e.g., SLEEP, BENCHMARK, UNION) in query strings.
• Use a Web Application Firewall (WAF) to block SQL injection patterns.

Mitigation:

• Immediately disable the GeoDirectory plugin if no patch is available.
• Implement input validation and parameterized queries in custom code.
• Apply virtual patching via WAF rules.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with dist parameter containing SQL keywords (e.g., SLEEP, BENCHMARK, UNION).
  • Unusually long response times for specific requests.
• File IOCs:
  • Modified WordPress database entries (e.g., new admin users).
  • Suspicious entries in web server access logs with dist parameter anomalies.
• Log IOCs:
  • Repeated SQL error messages in WordPress debug logs.
  • Time-based patterns in access logs (e.g., consistent 5-second delays).

Detection Engineering

YARA Rule

rule CVE_2024_13507_GeoDirectory_SQLi {
    meta:
        description = "Detects SQL injection attempts targeting GeoDirectory dist parameter"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-13507"
    strings:
        $sqli1 = /dist=.*SLEEP\(/ nocase
        $sqli2 = /dist=.*BENCHMARK\(/ nocase
        $sqli3 = /dist=.*UNION.*SELECT/ nocase
        $sqli4 = /dist=.*AND.*SLEEP/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-13507 GeoDirectory SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts via the dist parameter in GeoDirectory plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains|all:
            - 'dist='
            - 'SLEEP'
            - 'BENCHMARK'
            - 'UNION'
    condition: selection
falsepositives:
    - Legitimate use of the word "sleep" in a search query (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-13507 GeoDirectory SQL Injection Attempt"; flow:to_server,established; content:"dist="; http_uri; pcre:"/dist=.*(SLEEP|BENCHMARK|UNION)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the GeoDirectory plugin until a patch is released.
2. Virtual Patching: Deploy WAF rules to block SQL injection patterns in the dist parameter.
3. Code Fix: The vendor must implement parameterized queries using $wpdb->prepare() or switch to prepared statements.
4. Monitoring: Enable detailed logging for all HTTP requests and monitor for anomalies.
5. User Education: Advise users to update the plugin as soon as a patched version is available.

Valters IT
Securing Digital Frontiers