CVE-2024-6457
📋 TL;DR
This vulnerability allows unauthenticated attackers to perform time-based SQL injection attacks through the 'woof_author' parameter in the HUSKY – Products Filter Professional for WooCommerce WordPress plugin. Attackers can extract sensitive information from the database by injecting malicious SQL queries. All WordPress sites using this plugin up to version 1.3.6 are affected.
💻 Affected Systems
- HUSKY – Products Filter Professional for WooCommerce WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including user credentials, payment information, and sensitive business data leading to full site takeover.
Likely Case
Extraction of user data, admin credentials, and sensitive business information from the WooCommerce database.
If Mitigated
Limited information disclosure if database permissions are properly restricted and input validation is enforced elsewhere.
🎯 Exploit Status
Time-based SQL injection requires more sophisticated exploitation but automated tools exist. The vulnerability is in a public parameter with no authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.7 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3116888/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins. 3. Find 'HUSKY – Products Filter Professional for WooCommerce'. 4. Click 'Update Now' or manually update to version 1.3.7+. 5. Verify the plugin is updated to at least version 1.3.7.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily disable the HUSKY Products Filter plugin until patched
wp plugin deactivate woocommerce-products-filter
Web Application Firewall rule
allBlock requests containing SQL injection patterns targeting woof_author parameter
Add WAF rule: Block if ARGS:woof_author contains SQL keywords like UNION, SELECT, SLEEP, BENCHMARK
🧯 If You Can't Patch
- Implement strict input validation for woof_author parameter at application level
- Restrict database user permissions to minimum required for plugin functionality
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > HUSKY Products Filter version. If version is 1.3.6 or lower, you are vulnerable.Check Version:
wp plugin get woocommerce-products-filter --field=versionVerify Fix Applied:
Verify plugin version is 1.3.7 or higher in WordPress admin panel. Test woof_author parameter with safe values to ensure functionality works without errors.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL errors in WordPress logs
- Multiple requests with woof_author parameter containing SQL keywords
- Long response times from woof_author requests (time-based injection)
Network Indicators:
- HTTP POST/GET requests to WordPress with woof_author parameter containing SQL injection patterns
- Unusual database query patterns from WordPress application
SIEM Query:
source="wordpress.log" AND ("woof_author" AND ("UNION" OR "SELECT" OR "SLEEP" OR "BENCHMARK"))🔗 References
- https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/by_author/index.php#L102
- https://plugins.trac.wordpress.org/changeset/3116888/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ecfdf7b1-9bb8-4c1d-a00a-ca1e44440cab?source=cve
- https://plugins.trac.wordpress.org/browser/woocommerce-products-filter/trunk/ext/by_author/index.php#L102
- https://plugins.trac.wordpress.org/changeset/3116888/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ecfdf7b1-9bb8-4c1d-a00a-ca1e44440cab?source=cve
