CVE-2024-13481
📋 TL;DR
This SQL injection vulnerability in the LTL Freight Quotes WordPress plugin allows unauthenticated attackers to execute arbitrary SQL commands through the 'edit_id' and 'dropship_edit_id' parameters. Attackers can extract sensitive data from the database, including user credentials and other confidential information. All WordPress sites using this plugin up to version 3.3.4 are affected.
💻 Affected Systems
- LTL Freight Quotes – R+L Carriers Edition WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, privilege escalation, and potential site takeover
Likely Case
Extraction of sensitive data including user information, plugin settings, and potentially WordPress credentials
If Mitigated
Limited impact with proper input validation and database permissions restricting query execution
🎯 Exploit Status
SQL injection via URL parameters requires minimal technical skill to exploit
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.3.5 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3241903/
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'LTL Freight Quotes – R+L Carriers Edition'
4. Click 'Update Now' if available
5. If no update appears, download version 3.3.5+ from WordPress.org
6. Deactivate old plugin, upload new version, activate
🔧 Temporary Workarounds
Disable vulnerable plugin
WordPressTemporarily deactivate the plugin until patched
wp plugin deactivate ltl-freight-quotes-rl-carriers-edition
Web Application Firewall rule
allBlock requests containing SQL injection patterns targeting edit_id and dropship_edit_id parameters
🧯 If You Can't Patch
- Implement strict input validation for all user-supplied parameters
- Apply principle of least privilege to database user accounts
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → LTL Freight Quotes plugin versionCheck Version:
wp plugin get ltl-freight-quotes-rl-carriers-edition --field=versionVerify Fix Applied:
Verify plugin version is 3.3.5 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in WordPress logs
- Multiple requests with SQL-like patterns in edit_id/dropship_edit_id parameters
Network Indicators:
- HTTP requests with SQL injection payloads in URL parameters
SIEM Query:
source="wordpress.log" AND ("edit_id" OR "dropship_edit_id") AND ("UNION" OR "SELECT" OR "FROM" OR "WHERE")