Description
WordPress LTL Freight Quotes 提供多款插件，用于提供在美国和加拿大之间进行少于整车装载（Less than Truckload,LTL）货物运输服务运费计算、货运跟踪和物流管理功能。其中 R+L Carrier Edition <=3.3.4、TForceEdition<=3.6.4、ABF Freight Edition <=3.3.7 存在SQL注入漏洞。攻击者可以利用该漏洞获取数据库敏感信息，窃取用户数据。
WordPress LTL Freight Quotes 多个插件存在 sql注入漏洞（CVE-2024-13481、CVE-2024-13478、CVE-2024-13485）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2024-13481
https://wpscan.com/vulnerability/9bf52cec-b5ef-4687-a2ee-09643806f893/
https://hackhalt.com/threat/cve-2024-13478/
https://github.com/RandomRobbieBF/CVE-2024-13478
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/ltl-freight-quotes-abf-edition/ltl-freight-quotes-abf-freight-edition-337-unauthenticated-sql-injection
https://patchstack.com/database/wordpress/plugin/ltl-freight-quotes-freightquote-edition/vulnerability/wordpress-ltl-freight-quotes-freightquote-edition-plugin-2-3-11-sql-injection-vulnerability
https://cert.hu/en/alerts?page=1173