CVE-2024-13475
📋 TL;DR
This SQL injection vulnerability in the Small Package Quotes – UPS Edition WordPress plugin allows unauthenticated attackers to execute arbitrary SQL queries through the 'edit_id' parameter. Attackers can extract sensitive information from the database, including user credentials and other confidential data. All WordPress sites using this plugin up to version 4.5.16 are affected.
💻 Affected Systems
- Small Package Quotes – UPS Edition WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and potential site takeover.
Likely Case
Extraction of sensitive data including user information, plugin settings, and potentially WordPress credentials.
If Mitigated
Limited impact with proper input validation and database permissions in place.
🎯 Exploit Status
Unauthenticated exploitation via HTTP requests. SQL injection is a well-understood attack vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 4.5.17 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3237693/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Small Package Quotes – UPS Edition'. 4. Click 'Update Now' if available. 5. Alternatively, download latest version from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
WordPressDisable the vulnerable plugin until patched
wp plugin deactivate small-package-quotes-ups-edition
WAF Rule Implementation
allBlock SQL injection patterns targeting the edit_id parameter
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block SQL injection patterns
- Restrict database user permissions to minimum required for plugin functionality
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin panel under Plugins → Installed PluginsCheck Version:
wp plugin get small-package-quotes-ups-edition --field=versionVerify Fix Applied:
Verify plugin version is 4.5.17 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in WordPress debug logs
- Multiple requests with SQL-like patterns in edit_id parameter
- Unexpected database queries from web server
Network Indicators:
- HTTP requests containing SQL injection payloads in parameters
- Unusual database connection patterns from web server
SIEM Query:
source="web_access.log" AND (edit_id CONTAINS "UNION" OR edit_id CONTAINS "SELECT" OR edit_id CONTAINS "--" OR edit_id CONTAINS "' OR '1'='1")