CVE-2024-13369
Published: 18 February 2025
Description
The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘review_id’ parameter in all versions up to, and including, 5.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Security Summary
CVE-2024-13369 is a time-based SQL injection vulnerability in the Tour Master - Tour Booking, Travel, Hotel plugin for WordPress, affecting all versions up to and including 5.3.7. The flaw arises from insufficient escaping of the user-supplied 'review_id' parameter and lack of sufficient preparation in the existing SQL query, allowing injection of additional SQL queries. It is classified under CWE-89 with a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating medium severity primarily due to high confidentiality impact.
Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By manipulating the 'review_id' parameter, they can append SQL queries to extract sensitive information from the database, such as user credentials or other confidential data stored in WordPress sites using the plugin.
Advisories and further details are available from references including the plugin's Codecanyon page, the Goodlayers changelog for Tour Master, and Wordfence threat intelligence, which may outline patches or mitigation steps for affected installations.
Details
- CWE(s)