SQL Injection Vulnerability in GeoDirectory – WP Business Directory Plugin

CVE-2024-13507

What is CVE-2024-13507?

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is susceptible to a time-based SQL Injection vulnerability. This arises from insufficient escaping of the user-supplied 'dist' parameter and inadequate preparation within the SQL queries, allowing unauthenticated attackers to manipulate existing queries. Exploiting this flaw enables them to append additional SQL commands, potentially leading to unauthorized access to sensitive database information.

References