CVE-2024-13435: Ebook Downloader SQL Injection Flaw

CVE-2024-13435 Overview

CVE-2024-13435 is a SQL injection vulnerability in the Ebook Downloader plugin for WordPress, affecting all versions up to and including 1.0. The flaw exists in the handling of the download parameter, which is concatenated into a SQL query without proper escaping or prepared statement use. Unauthenticated attackers can append arbitrary SQL clauses to the existing query and extract sensitive data from the WordPress database. The issue is tracked under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated attackers can exfiltrate sensitive database contents — including user records and credential hashes — through SQL injection on the download parameter.

Affected Products

Infoway Ebook Downloader plugin for WordPress, all versions
Ebook Downloader version 1.0 and earlier
WordPress sites with the ebook-downloader plugin installed and active

Discovery Timeline

2025-02-12 - CVE-2024-13435 published to NVD
2025-02-25 - Last updated in NVD database

Technical Details for CVE-2024-13435

Vulnerability Analysis

The Ebook Downloader plugin exposes a request handler that reads the download parameter directly from the HTTP request and inserts it into a SQL statement. The plugin does not sanitize the value with esc_sql(), nor does it use $wpdb->prepare() with parameter placeholders. As a result, an attacker controls a portion of the SQL syntax executed against the WordPress database.

Because the endpoint is reachable without authentication, exploitation requires no credentials, no user interaction, and no access to administrative pages. The vulnerability affects confidentiality only; injected queries can read data, but the existing query structure limits direct write or destructive impact in the documented attack pattern.

A typical exploitation path uses UNION-based or boolean-based injection to enumerate database tables and extract values from wp_users, including user_login and user_pass hashes. Attackers can then attempt offline cracking or use stolen session data for further compromise.

Root Cause

The root cause is the absence of parameterized queries in the plugin's download handler. User input flows directly into a SQL string at line 278 of ebook_plugin.php, as documented in the WordPress Plugin Code Review. The query relies on implicit string concatenation rather than the WordPress $wpdb->prepare() API.

Attack Vector

The attack is delivered over the network through a crafted HTTP request to the plugin endpoint that processes the download parameter. The request contains SQL metacharacters and additional clauses appended to the parameter value. The vulnerable handler executes the combined query against the WordPress MySQL backend and returns or reflects results that the attacker can observe directly or through error messages. Detailed analysis is available in the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2024-13435

Indicators of Compromise

HTTP requests to the Ebook Downloader endpoint containing SQL syntax in the download parameter, including UNION SELECT, --, ', OR 1=1, or SLEEP(.
Unexpected outbound traffic or repeated requests from a single IP enumerating sequential download values.
Web server access logs showing long, URL-encoded query strings targeting the ebook-downloader plugin path.
MySQL slow query log entries referencing the plugin's download query with anomalous WHERE clauses.

Detection Strategies

Inspect WordPress access logs for requests containing the download parameter with non-numeric or SQL-syntactic payloads.
Deploy a Web Application Firewall (WAF) rule set with OWASP CRS SQL injection signatures applied to plugin endpoints.
Correlate plugin endpoint hits with database error responses (HTTP 500) to identify probing activity.

Monitoring Recommendations

Enable MySQL general or audit logging on production WordPress hosts and alert on UNION or information_schema references.
Monitor for unauthenticated requests to plugin PHP files using tools such as auditd or web server access logging.
Track WordPress user table reads and authentication anomalies that may follow credential extraction.

How to Mitigate CVE-2024-13435

Immediate Actions Required

Deactivate and remove the Ebook Downloader plugin from any WordPress site where it is installed, as no patched version is identified.
Audit wp_users and wp_usermeta tables for unauthorized modifications and force a password reset for all accounts.
Rotate WordPress secret keys in wp-config.php (AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, NONCE_KEY) to invalidate stolen sessions.
Review web server and database logs for prior exploitation activity dating back to plugin installation.

Patch Information

As of the NVD last-modified date of 2025-02-25, no vendor-supplied patch is referenced for Infoway Ebook Downloader. The CVSS score of 7.5 reflects unauthenticated network exploitation with high confidentiality impact. Site operators should treat plugin removal as the primary remediation. Monitor the WordPress plugin repository for any future security update.

Workarounds

Block access to the vulnerable plugin endpoint at the web server or WAF layer until removal is complete.
Apply a virtual patch in ModSecurity or equivalent WAF that rejects download parameter values containing SQL metacharacters.
Restrict database user privileges for the WordPress account to the minimum required, removing FILE and cross-database access.

bash

# Example nginx rule to block SQLi patterns on the plugin endpoint
location ~* /wp-content/plugins/ebook-downloader/ {
    if ($args ~* "(union|select|sleep\(|information_schema|--|0x[0-9a-f]+)") {
        return 403;
    }
}