CVE-2024-43145
📋 TL;DR
This SQL injection vulnerability in the GeoDirectory WordPress plugin allows attackers to execute arbitrary SQL commands on affected databases. All WordPress sites running GeoDirectory versions up to 2.3.61 are potentially affected, potentially exposing sensitive data.
💻 Affected Systems
- GeoDirectory WordPress Plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, privilege escalation, or full system takeover via subsequent attacks.
Likely Case
Unauthorized access to sensitive plugin data, user information exposure, and potential WordPress admin access through credential extraction.
If Mitigated
Limited data exposure if proper input validation and database permissions are enforced, with minimal operational impact.
🎯 Exploit Status
SQL injection vulnerabilities are typically easy to exploit once details are known. No public exploit code identified yet.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.3.62 or later
Vendor Advisory: https://patchstack.com/database/vulnerability/geodirectory/wordpress-geodirectory-plugin-2-3-61-sql-injection-vulnerability?_s_id=cve
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find GeoDirectory and click 'Update Now'. 4. Verify update to version 2.3.62 or higher.
🔧 Temporary Workarounds
Temporary Plugin Deactivation
allDisable GeoDirectory plugin until patched
wp plugin deactivate geodirectory
Web Application Firewall Rules
allBlock SQL injection patterns targeting GeoDirectory endpoints
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in custom code
- Restrict database user permissions to minimum required access
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → GeoDirectory version numberCheck Version:
wp plugin get geodirectory --field=versionVerify Fix Applied:
Confirm GeoDirectory version is 2.3.62 or higher in WordPress admin📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts from single IP
- Unexpected plugin file modifications
Network Indicators:
- HTTP requests with SQL syntax in parameters to GeoDirectory endpoints
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND uri="*geodirectory*" AND (query="*SELECT*" OR query="*UNION*" OR query="*OR 1=1*")