SQL Injection Vulnerability in LTL Freight Quotes Plugin for WordPress
CVE-2024-13474

7.5HIGH

Key Information:

Vendor
Enituretechnology
Status
Ltl Freight Quotes – Purolator Edition
Vendor
CVE Published:
22 February 2025

Summary

The LTL Freight Quotes – Purolator Edition plugin for WordPress is susceptible to SQL Injection attacks through the 'dropship_edit_id' and 'edit_id' parameters. This vulnerability arises from inadequate escaping of user-supplied parameters and poor handling of SQL queries, allowing unauthenticated attackers to inject their own SQL statements into existing queries. As a result, there is a potential exposure of sensitive information stored within the database, making it crucial for users to update to a fixed version.

Affected Version(s)

LTL Freight Quotes – Purolator Edition * <= 2.2.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Colin Xu
.