CVE-2024-38795: Cridio Listingpro SQLi Vulnerability

CVE-2024-38795 Overview

CVE-2024-38795 is a critical SQL Injection vulnerability affecting the ListingPro plugin for WordPress developed by CridioStudio. This vulnerability allows unauthenticated attackers to inject malicious SQL commands through improperly sanitized user input, potentially compromising the entire WordPress database, including sensitive user credentials, payment information, and site configurations.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive database contents, modify or delete data, and potentially achieve full site compromise without requiring any authentication.

Affected Products

• CridioStudio ListingPro Plugin for WordPress versions through 2.9.4
• WordPress sites using vulnerable versions of listingpro-plugin
• All WordPress installations with unpatched ListingPro directory/listing functionality

Discovery Timeline

• 2024-08-29 - CVE CVE-2024-38795 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2024-38795

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) exists in the ListingPro WordPress plugin due to improper neutralization of special elements used in SQL commands. The plugin fails to adequately sanitize user-supplied input before incorporating it into database queries, allowing attackers to manipulate the query structure and execute arbitrary SQL statements.

The vulnerability is particularly severe because it requires no authentication to exploit. An unauthenticated remote attacker can craft malicious requests to the WordPress site running the vulnerable plugin, injecting SQL syntax that the database server will interpret as legitimate commands. This can lead to unauthorized data extraction, data manipulation, or complete database compromise.

Root Cause

The root cause of CVE-2024-38795 is the lack of proper input validation and parameterized queries in the ListingPro plugin. When user input is concatenated directly into SQL statements without escaping or using prepared statements, attackers can inject additional SQL clauses, operators, or complete statements. WordPress provides built-in functions like $wpdb->prepare() for safe query construction, but the vulnerable code paths in ListingPro do not implement these protections consistently.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication, user interaction, or special privileges. An attacker can remotely send crafted HTTP requests to a WordPress site running the vulnerable plugin. The malicious payload, embedded in request parameters, is processed by the plugin and executed against the underlying database.

A typical SQL Injection attack against this vulnerability would involve manipulating input parameters that are used in database queries. For example, an attacker could inject UNION-based payloads to extract data from other tables, time-based blind injection to enumerate database contents, or stacked queries to modify data. For detailed technical analysis, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2024-38795

Indicators of Compromise

• Unusual database queries in MySQL/MariaDB logs containing UNION SELECT, SLEEP(), BENCHMARK(), or hex-encoded strings
• Web server access logs showing requests with SQL syntax characters (single quotes, double dashes, semicolons) in URL parameters or POST data targeting ListingPro endpoints
• Unexpected database table dumps or exports in temporary directories
• New administrative users created without authorization or unexplained privilege changes
• Anomalous database performance or response times indicating time-based SQL injection attempts

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block common SQL injection patterns in requests to WordPress sites
• Enable and monitor MySQL/MariaDB query logging for malformed or suspicious queries originating from the WordPress application
• Implement file integrity monitoring on WordPress core files and plugin directories to detect post-exploitation modifications
• Configure intrusion detection systems (IDS) with signatures for SQL injection attack patterns

Monitoring Recommendations

• Monitor web server logs for repeated requests with special characters in parameters targeting the ListingPro plugin
• Set up alerts for failed database queries or SQL syntax errors that may indicate injection attempts
• Track authentication events and new user registrations for signs of unauthorized account creation
• Review database backup integrity and compare against known-good states to detect data manipulation

How to Mitigate CVE-2024-38795

Immediate Actions Required

• Update the ListingPro plugin to the latest patched version immediately
• Audit WordPress administrative accounts for any unauthorized additions or privilege changes
• Review database logs for evidence of exploitation and assess potential data exposure
• Consider temporarily disabling the ListingPro plugin if an immediate update is not possible
• Implement WAF rules to block SQL injection patterns while preparing for patching

Patch Information

CridioStudio has addressed this vulnerability in versions after 2.9.4. WordPress administrators should update the ListingPro plugin through the WordPress dashboard or by downloading the latest version directly from the vendor. After updating, verify the plugin version and conduct a security audit of the site to ensure no compromise occurred prior to patching.

Workarounds

• Deploy a Web Application Firewall with SQL injection protection rules to filter malicious requests
• Restrict access to WordPress admin and plugin endpoints using IP whitelisting where feasible
• Disable the ListingPro plugin temporarily until the patch can be applied in production environments
• Implement database user privilege restrictions to limit the impact of successful SQL injection

# Configuration example - Verify ListingPro plugin version
wp plugin list --name=listingpro-plugin --format=table

# Update ListingPro plugin to latest version
wp plugin update listingpro-plugin

# Check for suspicious admin users added recently
wp user list --role=administrator --format=table