CVE-2024-13483: Eniture LTL Freight Quotes SQLi Flaw

CVE-2024-13483 Overview

CVE-2024-13483 is a SQL Injection vulnerability [CWE-89] in the LTL Freight Quotes – SAIA Edition plugin for WordPress. The flaw affects all versions up to and including 2.2.10. The vulnerability resides in the edit_id and dropship_edit_id parameters, which are concatenated into SQL queries without sufficient escaping or prepared statements. Unauthenticated attackers can append additional SQL queries to existing ones to extract sensitive data from the WordPress database. The vulnerability is remotely exploitable over the network without user interaction or authentication.

Critical Impact
Unauthenticated attackers can extract sensitive information, including user credentials, session tokens, and configuration data, directly from the WordPress database.

Affected Products

Eniture LTL Freight Quotes – SAIA Edition plugin for WordPress
All versions up to and including 2.2.10
WordPress installations with the plugin active

Discovery Timeline

2025-02-19 - CVE-2024-13483 published to NVD
2025-02-25 - Last updated in NVD database

Technical Details for CVE-2024-13483

Vulnerability Analysis

The LTL Freight Quotes – SAIA Edition plugin processes the edit_id and dropship_edit_id HTTP parameters and injects their values directly into SQL statements. The plugin does not call wpdb::prepare() with parameter binding, nor does it cast or sanitize the inputs as integers. As a result, attacker-controlled SQL fragments execute within the original query context.

Because the affected endpoints are reachable without authentication, the attack surface includes any internet-exposed WordPress site running the plugin. Successful exploitation enables UNION-based or stacked extraction of arbitrary database tables, including the wp_users table containing hashed credentials and session tokens.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command [CWE-89]. The plugin trusts unsanitized user input and concatenates it into query strings rather than using parameterized statements provided by the WordPress $wpdb abstraction layer.

Attack Vector

Exploitation requires only a crafted HTTP request to the vulnerable endpoint with a malicious value supplied in the edit_id or dropship_edit_id parameter. No credentials or user interaction are required. Attackers typically begin with boolean or time-based blind techniques to fingerprint the schema, then escalate to UNION-based extraction of credentials and secrets.

No public proof-of-concept exploit is currently listed, and the vulnerability is not present in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is approximately 0.69%.

Detection Methods for CVE-2024-13483

Indicators of Compromise

HTTP requests containing SQL syntax such as UNION, SELECT, SLEEP(, or -- in the edit_id or dropship_edit_id parameters
Anomalous response times on plugin endpoints, indicative of time-based blind SQL injection
Unexpected database errors logged by WordPress or MySQL referencing the plugin's SQL queries
Outbound queries to wp_users or wp_options originating from plugin code paths

Detection Strategies

Inspect web server access logs for non-numeric values in edit_id and dropship_edit_id query parameters
Deploy a Web Application Firewall (WAF) rule set with SQL injection signatures targeting WordPress plugin endpoints
Monitor MySQL general or slow query logs for unusual UNION SELECT patterns originating from plugin requests

Monitoring Recommendations

Alert on repeated 500-series responses from plugin URLs, which often indicate injection probing
Track outbound queries against authentication-related tables and correlate with HTTP request sources
Integrate WordPress and webserver logs into a central SIEM for correlation across the attack chain

How to Mitigate CVE-2024-13483

Immediate Actions Required

Update the LTL Freight Quotes – SAIA Edition plugin to a version newer than 2.2.10 once released by the vendor
Audit WordPress user accounts and rotate credentials for any administrative users if exploitation is suspected
Review database logs for evidence of unauthorized SELECT queries against sensitive tables
Deploy WAF rules to block SQL injection patterns targeting the vulnerable parameters

Patch Information

The vendor has released a fix in the WordPress plugin repository. Refer to the WordPress Plugin Changeset for the corrective code changes and the Wordfence Vulnerability Analysis for detailed technical context.

Workarounds

Disable and remove the LTL Freight Quotes – SAIA Edition plugin until a patched version is installed
Restrict access to plugin administrative endpoints using IP allowlisting at the webserver or WAF
Apply virtual patching rules in a WAF to reject requests where edit_id or dropship_edit_id contain non-integer values

bash

# Example ModSecurity rule to block non-numeric edit_id values
SecRule ARGS:edit_id "!@rx ^[0-9]+$" \
    "id:1004813,phase:2,deny,status:403,\
    msg:'CVE-2024-13483 SQLi attempt in edit_id parameter'"
SecRule ARGS:dropship_edit_id "!@rx ^[0-9]+$" \
    "id:1004814,phase:2,deny,status:403,\
    msg:'CVE-2024-13483 SQLi attempt in dropship_edit_id parameter'"