CVE-2024-13489: Eniture LTL Freight Quotes SQLi Flaw

CVE-2024-13489 Overview

CVE-2024-13489 is a SQL Injection vulnerability affecting the LTL Freight Quotes – Old Dominion Edition plugin for WordPress. The flaw exists in all versions up to and including 4.2.10. It stems from insufficient escaping of the edit_id and dropship_edit_id parameters combined with inadequate query preparation. Unauthenticated attackers can append additional SQL statements to existing queries and extract sensitive information from the database. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Unauthenticated remote attackers can extract sensitive database contents, including credentials and personally identifiable information, through crafted HTTP requests targeting the vulnerable parameters.

Affected Products

Eniture LTL Freight Quotes – Old Dominion Edition plugin for WordPress
All versions up to and including 4.2.10
WordPress sites with the plugin installed and active

Discovery Timeline

2025-02-19 - CVE-2024-13489 published to NVD
2025-02-25 - Last updated in NVD database

Technical Details for CVE-2024-13489

Vulnerability Analysis

The vulnerability resides in the request handling logic of the LTL Freight Quotes – Old Dominion Edition plugin. The plugin accepts user-controlled values for edit_id and dropship_edit_id and concatenates them into SQL statements without proper sanitization or parameterization. An attacker can send crafted requests that break out of the intended query context and append arbitrary SQL.

The attack requires no authentication and no user interaction. It is exploitable over the network against any WordPress installation running the vulnerable plugin version. The EPSS score of 3.909% places this issue in the 88th percentile, indicating elevated exploitation likelihood relative to the broader CVE population.

Root Cause

The root cause is the absence of prepared statements and insufficient input escaping on the edit_id and dropship_edit_id request parameters. WordPress provides the $wpdb->prepare() API for safe query construction, but the affected code paths concatenate untrusted input directly into the SQL string. This violates secure coding practices documented in CWE-89.

Attack Vector

An unauthenticated attacker sends HTTP requests to plugin endpoints that process the edit_id or dropship_edit_id parameter. By supplying a payload containing UNION SELECT clauses or boolean-based blind injection patterns, the attacker manipulates the resulting query. The database returns data the attacker is not authorized to access, including WordPress user records and session tokens stored in the wp_users and wp_options tables. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-13489

Indicators of Compromise

HTTP requests containing SQL keywords such as UNION, SELECT, SLEEP, or INFORMATION_SCHEMA in the edit_id or dropship_edit_id parameters.
Unexpected database error messages in WordPress debug logs referencing plugin queries.
Anomalous spikes in plugin endpoint traffic from single IP addresses or distributed sources.
Outbound database queries returning unusually large result sets to plugin-related PHP processes.

Detection Strategies

Inspect web server access logs for requests containing URL-encoded SQL metacharacters such as %27, %20OR%20, or %20UNION%20 in plugin parameter values.
Deploy Web Application Firewall (WAF) rules targeting SQL injection patterns on requests to wp-admin/admin.php and plugin AJAX endpoints.
Monitor MySQL slow query and general query logs for unexpected UNION-based queries originating from the WordPress database user.

Monitoring Recommendations

Enable WordPress debug logging and forward logs to a centralized SIEM for query anomaly correlation.
Track plugin version inventory across WordPress deployments and alert on instances at version 4.2.10 or earlier.
Establish baseline traffic patterns for plugin endpoints and alert on deviations indicative of automated scanning.

How to Mitigate CVE-2024-13489

Immediate Actions Required

Update the LTL Freight Quotes – Old Dominion Edition plugin to a version newer than 4.2.10 immediately.
Audit WordPress user accounts and rotate administrator credentials if compromise is suspected.
Review database access logs for unauthorized SELECT queries against sensitive tables.
Deploy WAF rules blocking SQL injection patterns on the affected parameters until patching is complete.

Patch Information

The vendor addressed the vulnerability in the plugin repository. Refer to the WordPress Plugin Change Log for the specific code changes that introduce parameter preparation and escaping. Administrators should apply the update through the WordPress plugin management interface.

Workarounds

Disable the LTL Freight Quotes – Old Dominion Edition plugin until the patch can be applied.
Restrict access to WordPress admin endpoints by IP allowlisting at the web server or reverse proxy layer.
Configure a WAF to block requests containing SQL keywords in the edit_id and dropship_edit_id parameters.
Apply the principle of least privilege to the WordPress database user, removing unnecessary INFORMATION_SCHEMA access where feasible.

bash

# Example WAF rule snippet (ModSecurity) to block SQLi patterns on vulnerable parameters
SecRule ARGS:edit_id|ARGS:dropship_edit_id "@rx (?i)(union(\s|\+)+select|sleep\(|information_schema|--|;)" \
    "id:1004913,phase:2,deny,status:403,msg:'CVE-2024-13489 SQLi attempt blocked'"