CVE-2024-13234: Woobewoo Product Table SQLi Vulnerability

CVE-2024-13234 Overview

The Product Table by WBW plugin for WordPress contains a critical SQL Injection vulnerability in the additionalCondition parameter affecting all versions up to and including 2.1.2. The vulnerability exists due to insufficient escaping on user-supplied parameters and a lack of proper preparation on existing SQL queries. This security flaw enables unauthenticated attackers to append malicious SQL queries to legitimate database queries, potentially extracting sensitive information from the WordPress database.

Critical Impact
Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive data from the WordPress database, potentially compromising user credentials, personal information, and other confidential data stored within the site.

Affected Products

Woobewoo Product Table versions up to and including 2.1.2
WordPress sites using the Product Table by WBW plugin (Pro edition)
WooCommerce stores utilizing the vulnerable plugin for product displays

Discovery Timeline

2025-01-23 - CVE-2024-13234 published to NVD
2025-02-04 - Last updated in NVD database

Technical Details for CVE-2024-13234

Vulnerability Analysis

This SQL Injection vulnerability occurs in the Product Table by WBW WordPress plugin when processing the additionalCondition parameter. The plugin fails to properly sanitize and escape user-provided input before incorporating it into SQL queries. Without adequate parameterized queries or prepared statements, attackers can manipulate the SQL query structure to execute arbitrary database commands.

The vulnerability allows unauthenticated remote attackers to interact with the underlying database without any authentication requirements. Since no user interaction is needed and the attack can be performed over the network, the potential for exploitation is significant. Successful exploitation could result in complete database compromise, including extraction of user credentials, customer data, order information, and other sensitive WordPress and WooCommerce data.

Root Cause

The root cause of this vulnerability is improper input validation and the absence of parameterized queries when handling the additionalCondition parameter. The plugin directly incorporates user-supplied input into SQL statements without proper escaping or using prepared statements with placeholders. This classic SQL Injection pattern allows attackers to break out of the intended query context and inject their own SQL commands.

Attack Vector

The attack can be executed remotely over the network by unauthenticated users. Attackers craft malicious requests containing SQL injection payloads within the additionalCondition parameter. When the vulnerable plugin processes these requests, the injected SQL code is executed against the database, allowing attackers to perform unauthorized operations such as:

Extracting sensitive data from WordPress tables (users, posts, options)
Accessing WooCommerce customer and order data
Potentially modifying or deleting database records
Enumerating database structure and content

The vulnerability requires no special privileges or user interaction, making it particularly dangerous for publicly accessible WordPress installations.

Detection Methods for CVE-2024-13234

Indicators of Compromise

Unusual database queries containing SQL injection patterns in web server logs
Requests to the Product Table plugin endpoints with suspicious additionalCondition parameter values
Database query logs showing unexpected UNION SELECT, subqueries, or data extraction attempts
Anomalous outbound data transfers that may indicate data exfiltration

Detection Strategies

Monitor web application firewall (WAF) logs for SQL injection patterns targeting WordPress plugin endpoints
Implement database activity monitoring to detect unusual query patterns or unauthorized data access
Review Apache/Nginx access logs for requests containing SQL keywords in query parameters
Deploy intrusion detection rules specifically targeting the additionalCondition parameter manipulation

Monitoring Recommendations

Enable WordPress security logging to capture plugin-related requests and anomalies
Configure database audit logging to track all queries executed by the WordPress application
Set up alerts for unusual database query volumes or patterns indicative of data extraction
Monitor for unauthorized access attempts to WordPress admin areas following potential credential theft

How to Mitigate CVE-2024-13234

Immediate Actions Required

Update the Product Table by WBW plugin to the latest patched version immediately
If update is not immediately possible, disable the plugin until a patch can be applied
Review database logs for signs of prior exploitation attempts
Conduct a security audit of WordPress user accounts and consider password resets if compromise is suspected
Implement a Web Application Firewall (WAF) with SQL injection protection rules

Patch Information

Woobewoo has released a security patch addressing this vulnerability. The fix is available through the WordPress Plugin Repository Changeset. Administrators should update to a version newer than 2.1.2 to remediate this vulnerability. Additional technical details are available via the Wordfence Vulnerability Intel advisory.

Workarounds

Deploy a Web Application Firewall (WAF) with rules to block SQL injection attempts targeting the additionalCondition parameter
Temporarily disable the Product Table by WBW plugin if immediate patching is not feasible
Restrict access to the WordPress site using IP allowlisting if only specific users need access
Implement additional database-level controls to limit the WordPress database user's permissions

bash

# Example: Block suspicious requests at the web server level (Apache)
# Add to .htaccess in WordPress root directory
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{QUERY_STRING} additionalCondition=.*(\%27|'|union|select|insert|drop|update|delete) [NC]
RewriteRule .* - [F,L]
</IfModule>