CVE-2024-13507 in GeoDirectory Plugin
Summary
by MITRE • 07/26/2025
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to time-based SQL Injection via the dist parameter in all versions up to, and including, 2.8.97 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/26/2025
The vulnerability identified as CVE-2024-13507 affects the GeoDirectory plugin for WordPress, specifically targeting versions up to and including 2.8.97. This plugin serves as a business directory and classified listings solution, making it a common target for attackers seeking to exploit WordPress installations. The vulnerability manifests through a time-based SQL injection flaw that allows unauthenticated attackers to manipulate database queries through the dist parameter, which is used for distance calculations in directory listings. This type of vulnerability represents a significant security risk as it can be exploited without requiring any authentication credentials, making it particularly dangerous for widely deployed plugins.
The technical flaw stems from insufficient input validation and escaping mechanisms within the plugin's code handling of the dist parameter. When user-supplied input is directly incorporated into SQL queries without proper sanitization or parameterization, it creates an opportunity for attackers to inject malicious SQL code. The vulnerability specifically exploits the lack of sufficient preparation on existing SQL queries, allowing attackers to append additional SQL operations that can be executed within the context of the database connection. This time-based SQL injection technique relies on the database's response timing to infer information about the underlying data structure, making it particularly stealthy and difficult to detect through standard monitoring.
The operational impact of this vulnerability extends beyond simple data extraction, as it provides attackers with the capability to perform extensive reconnaissance of the database structure and content. Unauthenticated attackers can leverage this vulnerability to extract sensitive information including user credentials, personal data, business listings, and potentially administrative access details. The vulnerability affects the core functionality of the plugin by allowing manipulation of the distance calculation feature, which could be used to disrupt service availability or to gain unauthorized access to the underlying database system. Given the widespread use of WordPress plugins, this vulnerability could impact numerous websites simultaneously, creating a substantial attack surface for threat actors.
Mitigation strategies should focus on immediate plugin updates to versions that address the SQL injection vulnerability, as well as implementing additional security measures such as web application firewalls and database query monitoring. Organizations should also conduct thorough security assessments of their WordPress installations to identify other potential vulnerabilities in plugins and themes. The vulnerability aligns with CWE-89 which describes improper neutralization of special elements used in an SQL command, and corresponds to ATT&CK technique T1071.004 for application layer protocol: DNS, as attackers may use the extracted information to plan further attacks. Regular security auditing and input validation practices should be implemented to prevent similar vulnerabilities in the future, with particular attention to parameter handling in database queries.