CVE-2024-13234: Woobewoo Product Table SQLi Vulnerability

CVE-2024-13234 Overview

The Product Table by WBW plugin for WordPress contains a critical SQL Injection vulnerability in the additionalCondition parameter affecting all versions up to and including 2.1.2. The vulnerability exists due to insufficient escaping on user-supplied parameters and a lack of proper preparation on existing SQL queries. This security flaw enables unauthenticated attackers to append malicious SQL queries to legitimate database queries, potentially extracting sensitive information from the WordPress database.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive data from the WordPress database, potentially compromising user credentials, personal information, and other confidential data stored within the site.

Affected Products

• Woobewoo Product Table versions up to and including 2.1.2
• WordPress sites using the Product Table by WBW plugin (Pro edition)
• WooCommerce stores utilizing the vulnerable plugin for product displays

Discovery Timeline

• 2025-01-23 - CVE-2024-13234 published to NVD
• 2025-02-04 - Last updated in NVD database

Technical Details for CVE-2024-13234

Vulnerability Analysis

This SQL Injection vulnerability occurs in the Product Table by WBW WordPress plugin when processing the additionalCondition parameter. The plugin fails to properly sanitize and escape user-provided input before incorporating it into SQL queries. Without adequate parameterized queries or prepared statements, attackers can manipulate the SQL query structure to execute arbitrary database commands.

The vulnerability allows unauthenticated remote attackers to interact with the underlying database without any authentication requirements. Since no user interaction is needed and the attack can be performed over the network, the potential for exploitation is significant. Successful exploitation could result in complete database compromise, including extraction of user credentials, customer data, order information, and other sensitive WordPress and WooCommerce data.

Root Cause

The root cause of this vulnerability is improper input validation and the absence of parameterized queries when handling the additionalCondition parameter. The plugin directly incorporates user-supplied input into SQL statements without proper escaping or using prepared statements with placeholders. This classic SQL Injection pattern allows attackers to break out of the intended query context and inject their own SQL commands.

Attack Vector

The attack can be executed remotely over the network by unauthenticated users. Attackers craft malicious requests containing SQL injection payloads within the additionalCondition parameter. When the vulnerable plugin processes these requests, the injected SQL code is executed against the database, allowing attackers to perform unauthorized operations such as:

• Extracting sensitive data from WordPress tables (users, posts, options)
• Accessing WooCommerce customer and order data
• Potentially modifying or deleting database records
• Enumerating database structure and content

The vulnerability requires no special privileges or user interaction, making it particularly dangerous for publicly accessible WordPress installations.

Detection Methods for CVE-2024-13234

Indicators of Compromise

• Unusual database queries containing SQL injection patterns in web server logs
• Requests to the Product Table plugin endpoints with suspicious additionalCondition parameter values
• Database query logs showing unexpected UNION SELECT, subqueries, or data extraction attempts
• Anomalous outbound data transfers that may indicate data exfiltration

Detection Strategies

• Monitor web application firewall (WAF) logs for SQL injection patterns targeting WordPress plugin endpoints
• Implement database activity monitoring to detect unusual query patterns or unauthorized data access
• Review Apache/Nginx access logs for requests containing SQL keywords in query parameters
• Deploy intrusion detection rules specifically targeting the additionalCondition parameter manipulation

Monitoring Recommendations

• Enable WordPress security logging to capture plugin-related requests and anomalies
• Configure database audit logging to track all queries executed by the WordPress application
• Set up alerts for unusual database query volumes or patterns indicative of data extraction
• Monitor for unauthorized access attempts to WordPress admin areas following potential credential theft

How to Mitigate CVE-2024-13234

Immediate Actions Required

• Update the Product Table by WBW plugin to the latest patched version immediately
• If update is not immediately possible, disable the plugin until a patch can be applied
• Review database logs for signs of prior exploitation attempts
• Conduct a security audit of WordPress user accounts and consider password resets if compromise is suspected
• Implement a Web Application Firewall (WAF) with SQL injection protection rules

Patch Information

Woobewoo has released a security patch addressing this vulnerability. The fix is available through the WordPress Plugin Repository Changeset. Administrators should update to a version newer than 2.1.2 to remediate this vulnerability. Additional technical details are available via the Wordfence Vulnerability Intel advisory.

Workarounds

• Deploy a Web Application Firewall (WAF) with rules to block SQL injection attempts targeting the additionalCondition parameter
• Temporarily disable the Product Table by WBW plugin if immediate patching is not feasible
• Restrict access to the WordPress site using IP allowlisting if only specific users need access
• Implement additional database-level controls to limit the WordPress database user's permissions

# Example: Block suspicious requests at the web server level (Apache)
# Add to .htaccess in WordPress root directory
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} additionalCondition=.*(\%27|'|union|select|insert|drop|update|delete) [NC]
RewriteRule .* - [F,L]
</IfModule>