CVE-2024-13369
Published: 18 February 2025
Summary
CVE-2024-13369 is a medium-severity SQL Injection (CWE-89) vulnerability in Goodlayers Tour Master. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 25.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-13369 is a time-based SQL injection vulnerability in the Tour Master - Tour Booking, Travel, Hotel plugin for WordPress, affecting all versions up to and including 5.3.7. The flaw arises from insufficient escaping of the user-supplied 'review_id' parameter and lack of sufficient preparation in the existing SQL query, allowing injection of additional SQL queries. It is classified under CWE-89 with a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), indicating medium severity primarily due to high confidentiality impact.
Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. By manipulating the 'review_id' parameter, they can append SQL queries to extract sensitive information from the database, such as user credentials or other confidential data stored in WordPress sites using the plugin.
Advisories and further details are available from references including the plugin's Codecanyon page, the Goodlayers changelog for Tour Master, and Wordfence threat intelligence, which may outline patches or mitigation steps for affected installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4528
Vulnerability details
The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘review_id’ parameter in all versions up to, and including, 5.3.7 due to insufficient escaping on the user supplied parameter and lack…
more
of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing WordPress plugin directly enables T1190 exploitation for initial access and data theft; facilitates T1213.006 by allowing unauthorized database queries to extract credentials and sensitive data.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly prevents SQL injection by requiring validation and sanitization of user-supplied parameters like 'review_id' to block insufficient escaping and query manipulation.
SI-2 mandates timely patching of known flaws such as the SQL injection vulnerability in Tour Master plugin versions up to 5.3.7.
RA-5 requires vulnerability scanning that identifies SQL injection flaws like CVE-2024-13369 in web applications and plugins, enabling proactive remediation.